Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,689
Total alertas
4802
Críticas
17240
Altas
8
Ransomware
1388
Esta semana
RSS
Vulnerabilidades × nvd × Limpiar todo ×
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95590] Subscriber SQL Injection in Tainacan <= 1.2.0 versions.
Subscriber SQL Injection in Tainacan
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95593] Editor SQL Injection in Ultimeter <= 3.0.8 versions.
Editor SQL Injection in Ultimeter
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95515] Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95522] Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.
Shop manager SQL Injection in Easy Digital Downloads
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95513] Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita…
Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-94487] Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-94174] Administrator SQL Injection in Email Log <= 2.63 versions.
Administrator SQL Injection in Email Log
nvdaltovulnerabilidad CVSS 7.6 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
23/09/2026
[CVE-2026-94176] Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-94179] Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.
Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-94181] An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the brows…
An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a element that triggers requestFullscreen without displaying the fullscreen notification.
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-94124] Contributor SQL Injection in WP EasyCart <= 5.9.4 versions.
Contributor SQL Injection in WP EasyCart
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-93622] Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.
Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-93773] Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.
Contributor SQL Injection in Mollie Forms
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-93774] Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-93526] Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.
Unauthenticated Cross Site Scripting (XSS) in Event Tickets
nvdaltovulnerabilidad CVSS 7.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
23/09/2026
[CVE-2026-93527] Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions.
Contributor SQL Injection in Live Copy Paste for Elementor
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-84486] A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views t…
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependency, and workflow schedulers are configured to allow any user (including unauthenticated clients) and are routed in production builds because their URL include is not gated on the debug setting. An unauthenticated remote attacker can repeatedly invoke these endp…
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-84499] A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions o…
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification, the controller decrypts the stored password and includes its plaintext value in the minimum/maximum len…
nvdaltovulnerabilidad CVSS 7.7 NVD
M Crítico vulnerabilidad
23/09/2026
[CVE-2026-84502] A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_ur…
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module. Because the module runs git ls-remote with the URL as a positional argument and without a "--" separator, a git project URL such as "--upload-pack=:x" is interpreted by gi…
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
23/09/2026
[CVE-2026-84474] A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-c…
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret (host_config_key) is exposed to users holding only the read-level view_jobtemplate permission -- both in the job template API representation and in the activity stream -- and the provisioning callback endpoint trusts a client-supplied X-Forwarded-For header to determine the calling ho…
nvdcriticovulnerabilidad CVSS 9.9 NVD