Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 15 min
14,078
Total alertas
3213
Críticas
10592
Altas
8
Ransomware
1068
Esta semana
RSS
Vulnerabilidades × vulnerabilidad × Limpiar todo ×
M Alto vulnerabilidad
30/06/2026
[CVE-2025-71374] picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used …
picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files that bypass picklescan detection and achieve code execution upon deserialization.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Crítico vulnerabilidad
30/06/2026
[CVE-2026-58449] txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint whose function body …
txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint whose function body parameter is resolved through txtai.util.Resolver, which performs __import__ and getattr on the caller-supplied dotted path with no allowlist. When the API is exposed with no TOKEN configured (authentication is opt-in, so all endpoints are unauthenticated) and the index is configured writable, a rem…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/06/2026
[CVE-2026-50003] A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode wr…
A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
30/06/2026
[CVE-2026-50254] An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak m…
An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp in its default single-process mode, memory grows quickly and the service is eventually killed, after which it stops accepting connections until an operator restarts it.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
30/06/2026
[CVE-2026-52196] Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to…
Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_416f28 component
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
30/06/2026
[CVE-2026-52868] An unauthenticated attacker can read worklist records from a directory outside the intended per-AE w…
An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storage area. In a multi-area deployment, this can cross departmental or clinic data separation.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
30/06/2026
[CVE-2026-57585] MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out…
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.
nvdaltovulnerabilidad CVSS 7.5 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
I Alto vulnerabilidad
30/06/2026
[CVE-2026-11541] IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Se…
IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
30/06/2026
[CVE-2026-35505] An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. I…
An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. In single-process deployments the memory grows until the service is killed and the port stops responding until restart.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
30/06/2026
[CVE-2026-37106] An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via …
An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php. NOTE: this is disputed by the Supplier because this is the intentional behavior when the product is configured for self-registration (a non-default feature). The supplier also notes that there is no configuration migration scenario that would result in the self…
nvdcriticovulnerabilidad CVSS 9.8 NVD
I Alto vulnerabilidad
30/06/2026
[CVE-2025-36359] IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expirati…
IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could allow an authenticated user to impersonate another user on the system.
nvdaltovulnerabilidad CVSS 8.1 NVD
I Alto vulnerabilidad
30/06/2026
[CVE-2026-11594] IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in…
IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console.
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
30/06/2026
[CVE-2026-13207] FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path no…
FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path normalization in the REST API. The API router fails to normalize dot-segment sequences before applying authentication middleware, allowing unauthenticated requests to access protected endpoints by prefixing paths with dot-segments such as /api/./users, /api/./roles, and /api/project/../users. These re…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
30/06/2026
[CVE-2026-44628] An unauthenticated attacker can crash the worklist server with a single crafted query when the serve…
An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid Called AE Title / storage directory, the expected lockfile, and at least one matching worklist record.
nvdaltovulnerabilidad CVSS 7.5 NVD
L Crítico vulnerabilidad
30/06/2026
[CVE-2026-7663] IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP p…
IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.
nvdcriticovulnerabilidad CVSS 9.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
L Crítico vulnerabilidad
30/06/2026
[CVE-2026-7803] IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validatio…
IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields.
nvdcriticovulnerabilidad CVSS 9.8 NVD
L Crítico vulnerabilidad
30/06/2026
[CVE-2026-7871] IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with …
IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with full application privileges, compromising all secrets, data, and system integrity.
nvdcriticovulnerabilidad CVSS 9.8 NVD
L Crítico vulnerabilidad
30/06/2026
[CVE-2026-7873] IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS command…
IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.
nvdcriticovulnerabilidad CVSS 9.9 NVD
L Crítico vulnerabilidad
30/06/2026
[CVE-2026-7874] IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due …
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due to the use of a weak and reversible key derivation mechanism for encryption at rest.
nvdcriticovulnerabilidad CVSS 9.1 NVD
I Alto vulnerabilidad
30/06/2026
[CVE-2026-13772] IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacke…
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at three distinct sinks (SELECT NEW, enum literals, and reflection-based comparators); an authenticated remote attacker who can influence an application-built OQL query string can execute arbitrary construct…
nvdaltovulnerabilidad CVSS 7.5 NVD