Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,181
Total alertas
4701
Críticas
16892
Altas
8
Ransomware
1052
Esta semana
RSS
Vulnerabilidades × cwe-79 × Limpiar todo ×
M Alto vulnerabilidad
05/09/2026
[CVE-2026-77233] The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vu…
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execu…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
05/09/2026
[CVE-2026-77263] The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vu…
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesse…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2022-35499] In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site …
In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
04/09/2026
Vulnerabilidad XSS alta en OpenPanel anterior a 2.3.0 permite ejecución de scripts remota
OpenPanel antes de la versión 2.3.0 contiene una vulnerabilidad de cross-site scripting (XSS) en el endpoint no autenticado GET /misc/favicon que permite a atacantes remotos ejecutar código malicioso mediante archivos SVG. Los atacantes pueden alojar archivos SVG con scripts embebidos que se ejecutan en el navegador de la víctima con el origen de la API, facilitando solicitudes autenticadas a endpoints protegidos. Esta vulnerabilidad afecta infraestructuras de hosting y control de paneles en servidores de empresas LATAM.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
04/09/2026
Vulnerabilidad XPS almacenado en Grav Shortcode Core anterior a 6.2.5
Grav Shortcode Core versiones anteriores a 6.2.5 contiene vulnerabilidades de cross-site scripting (XSS) almacenado en los parámetros de etiqueta [lorem] y resumen [details], que se renderizan sin validación. Atacantes con acceso de edición pueden inyectar código HTML y JavaScript arbitrario que se ejecuta en navegadores de visitantes, incluidos administradores. Afecta sitios Grav en producción que permiten edición de contenido a múltiples usuarios.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Crítico vulnerabilidad
03/09/2026
[CVE-2026-85061] MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanit…
MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied cust…
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Alto vulnerabilidad
03/09/2026
[CVE-2026-84812] Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.
Unauthenticated Cross Site Scripting (XSS) in BP Better Messages
nvdaltovulnerabilidad CVSS 7.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
03/09/2026
[CVE-2026-84848] Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions.
Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
03/09/2026
[CVE-2026-84773] Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions.
Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
03/09/2026
[CVE-2026-84763] Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions.
Unauthenticated Cross Site Scripting (XSS) in RTMKit
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
03/09/2026
[CVE-2026-84765] Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
03/09/2026
[CVE-2026-81292] Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Simple Payment
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
03/09/2026
[CVE-2026-81295] Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions.
Unauthenticated Cross Site Scripting (XSS) in Under Construction
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
03/09/2026
[CVE-2026-81300] Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.
Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
03/09/2026
[CVE-2026-81773] Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions…
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension
nvdaltovulnerabilidad CVSS 7.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
03/09/2026
[CVE-2026-81776] Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions.
Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
02/09/2026
[CVE-2026-84665] Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard lin…
Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
nvdaltovulnerabilidad CVSS 8.0 NVD
M Alto vulnerabilidad
02/09/2026
[CVE-2026-84673] Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's …
Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
02/09/2026
[CVE-2026-84648] In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log rec…
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestamp) resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers in control of agent processes.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
02/09/2026
[CVE-2026-76759] Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.
Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.
nvdaltovulnerabilidad CVSS 7.3 NVD