Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 1 hora
22,093
Total alertas
4671
Críticas
16834
Altas
8
Ransomware
1003
Esta semana
RSS
Vulnerabilidades × cwe-502 × Limpiar todo ×
M Alto vulnerabilidad
15/06/2026
[CVE-2026-39474] Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions.
Contributor PHP Object Injection in Post Duplicator
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-39478] Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versio…
Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-39481] Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions.
Author PHP Object Injection in Modula Image Gallery
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-39471] Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.
Author PHP Object Injection in ShortPixel Image Optimizer
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-39472] Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.
Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-39434] Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions.
Shop manager PHP Object Injection in CTX Feed
nvdaltovulnerabilidad CVSS 7.2 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-27053] Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.
Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
15/06/2026
[CVE-2026-27333] Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions.
Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site
nvdaltovulnerabilidad CVSS 8.1 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-39006] An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgS…
An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
14/06/2026
[CVE-2026-12191] A vulnerability was found in Comma AI Openpilot 0.11. This issue affects the function pickle.load/pi…
A vulnerability was found in Comma AI Openpilot 0.11. This issue affects the function pickle.load/pickle.loads of the file selfdrive/modeld/modeld.py of the component Pickle Module. The manipulation results in deserialization. The attack is only possible with local access. The vendor was contacted early about this disclosure but did not respond in any way.
nvdaltovulnerabilidad CVSS 7.8 NVD
A Alto vulnerabilidad
12/06/2026
[CVE-2026-50632] A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lea…
A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
nvdaltovulnerabilidad CVSS 8.1 NVD
A Alto vulnerabilidad
12/06/2026
[CVE-2026-50633] A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can…
A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.
nvdaltovulnerabilidad CVSS 8.1 NVD
V Alto vulnerabilidad
11/06/2026
[CVE-2026-41699] Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated G…
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization. Affected versions: Spring for GraphQL 2.0.0 …
nvdaltovulnerabilidad CVSS 8.1 NVD
S Alto vulnerabilidad
10/06/2026
[CVE-2026-20251] In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versio…
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could perform a Remote Code Execution (RCE) through the Splunk Secure Gateway app.
nvdaltovulnerabilidad CVSS 8.8 NVD
J Alto vulnerabilidad
10/06/2026
[CVE-2026-53435] In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins …
In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an attacker-controlled `config.xml` submission in a way that allows them to handle HTTP requests afterwards. This can be used to impersonate any user and send HTTP requests on their behalf, up to and including use of the Script Cons…
nvdaltovulnerabilidad CVSS 8.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
N Alto vulnerabilidad
10/06/2026
[CVE-2026-52751] Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RM…
Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated remote code execution. Attackers can craft a malicious project file with a ghidra:// URL that, when opened via File → Open Project, deserializes untrusted objects using a Jython 2.7.4 gadget chain to execute arbitrary commands.
nvdaltovulnerabilidad CVSS 8.8 NVD
V Alto vulnerabilidad
10/06/2026
[CVE-2026-41731] JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trust…
JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted header values that caused the consumer to deserialize arbitrary JDK types. Affected versions: Spring f…
nvdaltovulnerabilidad CVSS 8.1 NVD
V Alto vulnerabilidad
10/06/2026
[CVE-2026-41732] JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning t…
JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default allow-list. Affected versions: Spring for Apache Pulsar 2.0.0 through 2.0.5; 1.2.0 through 1.2.17; 1.1.0 t…
nvdaltovulnerabilidad CVSS 8.1 NVD
V Alto vulnerabilidad
10/06/2026
[CVE-2026-40993] An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataReposi…
An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively). Affected versions: Spring Security 7.0.0 through 7.0.5.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
09/06/2026
[CVE-2026-45484] Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to el…
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
nvdaltovulnerabilidad CVSS 8.8 NVD