Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Multiple Vendors" — 19247 resultados ✕ Limpiar búsqueda
24,989
Total alertas
5080
Críticas
19092
Altas
8
Ransomware
2872
Esta semana
RSS
Vulnerabilidades × Limpiar todo ×
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86434] league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulne…
league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOf…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86427] LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter tha…
LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter that allows authenticated attackers to inject arbitrary rrdtool arguments by breaking out of double-quote escaping. Attackers can inject DEF and LINE arguments to read RRD files from unauthorized devices, or use newline injection to execute arbitrary rrdtool commands, bypassing per-device authorization…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-80135] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Check or Handling of Exceptional Conditions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
07/09/2026
[CVE-2026-80238] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privileges vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass. This vulnerability is considered critical because a low-privileged operator with SSH access …
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86303] A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Aff…
A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Affected by this issue is the function lds of the file md.c. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. Thi…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86305] A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf4…
A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function Upload::upload of the file ThinkPHP/Library/Think/Upload.class.php. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and …
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86306] A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601…
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects an unknown part of the file App/Home/Model/UserModel.class.php of the component Cookie Helper. Executing a manipulation of the argument Username can lead to improper authentication. The attack may be performed from remote. The exploit has been made availab…
nvdaltovulnerabilidad CVSS 7.3 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
07/09/2026
[CVE-2026-79678] A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-…
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via me…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-80132] ell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.…
ell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-80133] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path Traversal vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-80134] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-6431] The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugi…
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts …
nvdaltovulnerabilidad CVSS 7.2 NVD
M Crítico vulnerabilidad
07/09/2026
[CVE-2026-76578] A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does…
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it add…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-61409] Dell Secure Connect Gateway (SCG) 5.0 Application, versions prior to 5.36.00.00, contains an Imprope…
Dell Secure Connect Gateway (SCG) 5.0 Application, versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Crítico vulnerabilidad
07/09/2026
[CVE-2026-61410] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authorization vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution. This vulnerability is considered critical because it allows an attacker to execute commands remotely on a target system…
nvdcriticovulnerabilidad CVSS 9.4 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
07/09/2026
[CVE-2026-6223] Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality …
Improper restriction of excessive authentication attempts vulnerability in Bahçelievler Muncipality BiHayat App allows Authentication Bypass. This issue affects BiHayat App: from 2.1.7 through 07092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
nvdcriticovulnerabilidad CVSS 9.4 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2022-51017] PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submi…
PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAG_String limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data serialization, causing server crashes.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
07/09/2026
Inyección de comandos OS crítica en Linksys RE7000 2.0.15 permite ejecución remota
Se ha identificado una vulnerabilidad crítica (CVSS 9.9) en el repetidor inalámbrico Linksys RE7000 versión 2.0.15. Un atacante remoto puede inyectar comandos del sistema operativo manipulando parámetros de prueba ping (pingTestIp, pingTestPktSize, pingTestTimes) en el componente /cgi-bin/json.cgi?PingTest. El exploit es público y activamente explotado, afectando infraestructuras de redes corporativas y MiPyMEs en México y Latinoamérica que dependan de este dispositivo.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Alto vulnerabilidad
07/09/2026
Vulnerabilidad de autenticación impropia en Tenda AC9 15.03.05.14 (CVE-2026-86300)
Se identificó un fallo en el manejador R7WebsSecurityHandler del componente de gestión web en routers Tenda AC9 versión 15.03.05.14 que permite eludir autenticación de forma remota. Esta vulnerabilidad de CVSS 7.3 afecta principalmente a pequeñas y medianas empresas en LATAM que utilizan estos dispositivos en redes corporativas. El exploit ya está público, aumentando significativamente el riesgo de explotación.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
07/09/2026
Vulnerabilidad alta en Artemis de EAP: deserialización insegura por defecto
EAP's Artemis permite deserialización de objetos sin validación de seguridad por defecto, exponiendo servidores a ejecución remota de código malicioso. El método ObjectMessage.getObject() utiliza ObjectInputStreamWithClassLoader con listas de permitidos/bloqueados vacías, lo que acepta cualquier clase. Empresas en LATAM con infraestructura Java en producción enfrentan riesgo alta de compromiso de sistemas.
nvdaltovulnerabilidad CVSS 8.8 NVD