Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,539
Total alertas
3075
Críticas
10192
Altas
8
Ransomware
1790
Esta semana
RSS
Vulnerabilidades × critico × Limpiar todo ×
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-45388] In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate pro…
In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate provided by the server, which allows impersonation with certificates that are not meant for server authentication (because of KeyUsage and ExtendedKeyUsage).
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-45390] In OCaml-tar before 3.4.0, a crafted archive with ../ path segments in its name allows escaping the …
In OCaml-tar before 3.4.0, a crafted archive with ../ path segments in its name allows escaping the current working directory. This is not desired behavior, and tar(1) rejects such extractions, but ocaml-tar decompresses it anyway. The impact is that it allows arbitrary file writes outside of the desired extraction directory (to an attacker that can reach a tar decompression endpoint).
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-48114] Metacat is data repository software that helps researchers preserve, share, and discover data. Versi…
Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL injection in the /harvesterRegistration endpoint. HarvesterRegistration.dbInsert() builds an INSERT against HARVEST_SITE_SCHEDULE via string concatenation, using a quoteString() helper that performs raw single-quote wrapping without escaping. Th…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-38329] Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. The POST /ap…
Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. The POST /api/files/{key} endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and execute arbitrary code on the server.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-38812] RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affect…
RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affects the code generation module and may allow an authenticated attacker with administrative privileges to access sensitive database information.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-39006] An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgS…
An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-39196] Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_q…
Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_query parameter in the KeyPartitioner::partition function. This vulnerability allows attackers to access sensitive database information via crafted SQL statements.
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-38060] Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_unlo…
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_unlock_sim via the pin parameter.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-38061] Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_…
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_volume via the volume parameter.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-38062] Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_…
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_rat_mode via the ratMode parameter.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-38063] Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_radi…
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_radio_on_with_ia_apn via the ia parameter.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-38064] Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_dial…
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_dial_call via the dialNumber parameter.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-38065] Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_ims_…
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_ims_on_with_apn via the ims_apn parameter.
nvdcriticovulnerabilidad CVSS 9.8 NVD
R Crítico vulnerabilidad
15/06/2026
[CVE-2026-30120] remotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability…
remotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability.
nvdcriticovulnerabilidad CVSS 9.8 NVD
R Crítico vulnerabilidad
15/06/2026
[CVE-2026-30121] remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability.
remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability.
nvdcriticovulnerabilidad CVSS 9.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-36537] ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code e…
ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote attacker can bypass authentication and gain full access to any existing user account on the platform w…
nvdcriticovulnerabilidad CVSS 9.8 NVD
F Crítico vulnerabilidad
15/06/2026
[CVE-2026-9862] Fortra's  Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in th…
Fortra's  Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-52704] Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce P…
Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code Inclusion. This issue affects WooCommerce PDF Invoice Builder: from n/a through 2.0.8.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2018-25436] WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulne…
WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload arbitrary files by exploiting the upload-package.php endpoint. Attackers can submit POST requests with malicious file extensions to the upload handler, which moves files without validation to the plugin upload directory, enabling remote code e…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-8935] The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given …
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin access.
nvdcriticovulnerabilidad CVSS 9.8 NVD