Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
24,658
Total alertas
5025
Críticas
18870
Altas
8
Ransomware
2769
Esta semana
RSS
Vulnerabilidades × alto × Limpiar todo ×
M Alto vulnerabilidad
09/09/2026
[CVE-2026-87766] A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new ro…
A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-14359] The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in …
The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the add_user_in_waiting_list() function registered on the wp_ajax_yith_wcwtl_add_user action being missing both a capability check and a nonce verification, and using parse_str() + extract() to import attacker-controlled variables from $_POST['pa…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-14989] The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored…
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpl_user_preference' parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user access…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-78491] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-78494] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-79636] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Validation of Certificate with Host Mismatch vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.
nvdaltovulnerabilidad CVSS 7.0 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-80123] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.
nvdaltovulnerabilidad CVSS 7.3 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
09/09/2026
[CVE-2026-75927] The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus…
The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the `addPluginCapabilities()` function unconditionally granting the Editor role all 15 `manage_capabilities_*` capabilities — including `manage_capabilities`, `manage_capabilities…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-83593] The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulner…
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-84068] The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before u…
The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticated attackers to extract arbitrary data from the database via SQL injection.
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-76009] The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication By…
The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the `NCWM_Kitconnect::run()` function. This is due to the plugin registering the `/wp-json/next_cart/v1/migration` REST route with `permission_callback` set to `__return_true` and relying on a hardcoded fallback value of `__token__` in `get_option…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-14962] The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and es…
The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database.
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-16960] The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to…
The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-87734] An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly …
An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-84293] The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Script…
The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected p…
nvdaltovulnerabilidad CVSS 7.2 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
09/09/2026
[CVE-2026-6485] UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands or startup scripts.
UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands or startup scripts.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-49314] OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of …
OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of this vulnerability may affect availability.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-49315] DoS vulnerability in the input device module. Impact: Successful exploitation of this vulnerability …
DoS vulnerability in the input device module. Impact: Successful exploitation of this vulnerability may affect availability.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-49310] Permission control vulnerability in the event notification module. Impact: Successful exploitation o…
Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-12855] Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in th…
Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects.
nvdaltovulnerabilidad CVSS 8.2 NVD