Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,181
Total alertas
4701
Críticas
16892
Altas
8
Ransomware
1055
Esta semana
RSS
Vulnerabilidades × cwe-79 × Limpiar todo ×
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95528] Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions…
Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95529] Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95515] Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-94176] Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-94179] Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.
Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-93622] Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.
Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-93774] Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus
nvdaltovulnerabilidad CVSS 7.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
23/09/2026
[CVE-2026-93526] Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.
Unauthenticated Cross Site Scripting (XSS) in Event Tickets
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-77394] OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or mor…
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator's …
nvdaltovulnerabilidad CVSS 7.6 NVD
M Crítico vulnerabilidad
23/09/2026
[CVE-2026-18872] IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scri…
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42). A malicious actor can inject script into stored network acknowledgement data that executes in authenticated operator browsers, enabling session hijacking and unauthorized operator-level payment actio…
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
23/09/2026
[CVE-2026-59167] SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. P…
SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handl…
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Alto vulnerabilidad
23/09/2026
Vulnerabilidad alta en Tauri: omisión de CSP permite ejecución arbitraria de scripts
Tauri contiene una falla en su mecanismo de Content Security Policy (CSP) que permite a atacantes ejecutar scripts arbitrarios al incluir esquemas data: o blob: en la directiva script-src, anulando la protección del nonce aleatorio. Aplicaciones Tauri en México y LATAM que procesen contenido dinámico están expuestas a inyección de código y compromiso de datos sensibles.
nvdaltovulnerabilidad CVSS 8.3 NVD
M Alto vulnerabilidad
22/09/2026
[CVE-2026-18131] IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execut…
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary JavaScript in an authenticated user's browser due to improper neutralization of HTML input.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
22/09/2026
[CVE-2026-75744] Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting (XSS) vulnerability …
Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's accoun…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Crítico vulnerabilidad
22/09/2026
[CVE-2026-75684] Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused …
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
nvdcriticovulnerabilidad CVSS 9.3 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
22/09/2026
[CVE-2026-75689] Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused …
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
22/09/2026
[CVE-2026-75697] Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused …
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
22/09/2026
[CVE-2026-75698] Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could…
Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web …
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Alto vulnerabilidad
22/09/2026
Vulnerabilidad XSS almacenado alta en plugin WP Yelp Review Slider (CVE-2026-93778)
El plugin WP Yelp Review Slider para WordPress en versiones hasta 9.2 presenta una vulnerabilidad de Cross-Site Scripting (XSS) almacenado que permite a atacantes no autenticados inyectar scripts maliciosos a través del texto de reseñas de Yelp importadas. La falta de sanitización de entrada y escapado de salida permite que estos scripts se ejecuten cuando usuarios acceden a páginas comprometidas, afectando potencialmente datos sensibles y sesiones de administradores en sitios WordPress de empresas en LATAM.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
22/09/2026
Vulnerabilidad XSS almacenado en WPC Product Bundles for WooCommerce (CVE-2026-93836)
El plugin WPC Product Bundles para WooCommerce contiene una vulnerabilidad de Cross-Site Scripting (XSS) almacenado en el parámetro 'qty' en versiones hasta 8.6.6, permitiendo a atacantes no autenticados inyectar código malicioso que se ejecuta cuando usuarios acceden a páginas comprometidas. Afecta tiendas en línea y plataformas de comercio electrónico en LATAM que utilizan WooCommerce. CVSS 7.2 (alto).
nvdaltovulnerabilidad CVSS 7.2 NVD