Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 1 hora
22,162
Total alertas
4698
Críticas
16876
Altas
8
Ransomware
1037
Esta semana
RSS
Vulnerabilidades × cwe-444 × Limpiar todo ×
M Alto vulnerabilidad
28/07/2026
[CVE-2026-15064] IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.…
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.
nvdaltovulnerabilidad CVSS 8.7 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-15325] IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.…
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP request smuggling due to improper handling of TRACE requests.
nvdaltovulnerabilidad CVSS 8.7 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-15328] IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.…
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to HTTP request smuggling.
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-67182] Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote atta…
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers can craft a header value containing a complete additional HTTP request that is interpreted as a sepa…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
14/07/2026
[CVE-2026-27690] Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could s…
Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.
nvdcriticovulnerabilidad CVSS 9.1 NVD
O Alto vulnerabilidad
08/07/2026
[CVE-2025-3110] OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values…
OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy
nvdaltovulnerabilidad CVSS 7.5 NVD
I Alto vulnerabilidad
30/06/2026
[CVE-2026-11541] IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Se…
IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.
nvdaltovulnerabilidad CVSS 7.4 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
I Alto vulnerabilidad
30/06/2026
[CVE-2026-11806] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary fil…
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.
nvdaltovulnerabilidad CVSS 7.2 NVD
A Crítico vulnerabilidad
29/06/2026
[CVE-2026-13762] Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow…
Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue was remediated server-side. No customer action is required.
nvdcriticovulnerabilidad CVSS 9.8 NVD
A Crítico vulnerabilidad
29/06/2026
[CVE-2026-13763] Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled…
Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue only impacts HTTP/2 ALB target groups. To remediate this issue, customers should enable the "Insp…
nvdcriticovulnerabilidad CVSS 9.8 NVD
E Alto vulnerabilidad
26/06/2026
[CVE-2026-48743] Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35…
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, Envoy can translate a downstream HTTP/3 request that is complete at the transport layer (HEADERS with FIN / headers-only close) but still carries a nonzero Content-Length into a complete upstream HTTP/1 request with unresolved body debt. In an HTTP/1 upstream deploym…
nvdaltovulnerabilidad CVSS 7.5 NVD
C Alto vulnerabilidad
23/06/2026
[CVE-2026-52845] Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_…
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the…
nvdaltovulnerabilidad CVSS 8.1 NVD
V Crítico vulnerabilidad
22/06/2026
[CVE-2026-48746] vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a…
vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0.
nvdcriticovulnerabilidad CVSS 9.1 NVD
I Alto vulnerabilidad
22/06/2026
[CVE-2026-8646] IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3…
IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowing the attacker to bypass security controls, spoof identity, escalate privilege, and expose sensitive information.
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
17/06/2026
[CVE-2026-48979] PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography…
PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography, terminal UI, etc. In versions 6.1.0, 6.1.1 and 6.2.0, the Psl\H2\ServerConnection does not validate that the total bytes received in DATA frames match the content-length header declared in the HEADERS frame, allowing request smuggling. This is in violation of RFC 9113 §8.1.1. A malicious client is…
nvdaltovulnerabilidad CVSS 7.5 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
17/06/2026
[CVE-2026-54387] Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and…
Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable c…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
17/06/2026
[CVE-2026-54388] Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Cont…
Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all duplicate headers to the backend while using the first value to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backe…
nvdcriticovulnerabilidad CVSS 9.1 NVD