Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "X" — 17353 resultados ✕ Limpiar búsqueda
24,497
Total alertas
5005
Críticas
18787
Altas
8
Ransomware
2719
Esta semana
RSS
Vulnerabilidades × Limpiar todo ×
M Alto vulnerabilidad
29/07/2026
[CVE-2026-13425] The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array For…
The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by una…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-58151] Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and …
Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-58153] Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked frami…
Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
nvdaltovulnerabilidad CVSS 8.3 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-58154] Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP heade…
Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
nvdaltovulnerabilidad CVSS 8.9 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-58155] Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling,…
Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-41920] Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic S…
Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-57834] Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affect…
Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
nvdcriticovulnerabilidad CVSS 10.0 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-58150] Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade reque…
Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-18191] VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated…
VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden function to obtain the administrator credentials of the device.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-22068] Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apach…
Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-24033] Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Ap…
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-33267] Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic…
Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-63232] A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated att…
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-63233] A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated att…
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-63234] A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated att…
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.
nvdcriticovulnerabilidad CVSS 9.9 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
29/07/2026
[CVE-2026-11974] The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied parameter…
The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only …
nvdaltovulnerabilidad CVSS 8.6 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-13423] The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification …
The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions (for example to create an administrator account), leading to privilege escalation and remote code execut…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-14234] The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its A…
The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in stored Cross-Site Scripting.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-63227] An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module desig…
An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly accessible directory and execute arbitrary code on the server.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-18072] The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPre…
The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the `_arve_uc_init()` function — registered on WordPress's `init` hook at priority 1 so that it runs before any authentication checks on every request — reads an attacker-supplied t…
nvdcriticovulnerabilidad CVSS 9.8 NVD