Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,841
Total alertas
4833
Críticas
17354
Altas
8
Ransomware
1367
Esta semana
RSS
Vulnerabilidades × vulnerabilidad × Limpiar todo ×
M Alto vulnerabilidad
18/09/2026
[CVE-2026-93453] SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the a…
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid password-reset tokens mailed to victim recovery addresses within links pointing to attacker infrastruc…
nvdaltovulnerabilidad CVSS 8.3 NVD
M Crítico vulnerabilidad
18/09/2026
[CVE-2026-85878] Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate pri…
Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Alto vulnerabilidad
18/09/2026
[CVE-2026-85887] Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker …
Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
18/09/2026
[CVE-2026-83946] Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal…
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthorized attacker to perform spoofing over a network.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Crítico vulnerabilidad
18/09/2026
[CVE-2026-69843] Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate pri…
Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
18/09/2026
[CVE-2026-62874] Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to e…
Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-93435] redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser th…
redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust the V8 call stack, causing an uncaught RangeError that terminates the Node.js process without triggering…
nvdaltovulnerabilidad CVSS 7.5 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
17/09/2026
[CVE-2026-93436] vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests …
vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with max_tokens=0 to exhaust decode-worker memory without bound until the worker restarts.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-85885] Improper neutralization of special elements used in a command ('command injection') in M365 Copilot …
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-85889] Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to …
Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-85917] Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate pr…
Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-87701] Improper neutralization of special elements in output used by a downstream component ('injection') i…
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-87886] Local privilege escalation due to insecure file permissions. The following products are affected: Ac…
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-83944] Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges ov…
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-78501] Improper neutralization of special elements used in a command ('command injection') in Microsoft 365…
Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.
nvdaltovulnerabilidad CVSS 7.4 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-77903] Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate …
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 9.0 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-70200] Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps a…
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-70009] Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows a…
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-69865] Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthori…
Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-69399] Azure Arc Elevation of Privilege Vulnerability
Azure Arc Elevation of Privilege Vulnerability
nvdcriticovulnerabilidad CVSS 10.0 NVD