Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,696
Total alertas
3097
Críticas
10327
Altas
8
Ransomware
1772
Esta semana
RSS
Vulnerabilidades × critico × Limpiar todo ×
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-48030] Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before versi…
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution…
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-17552] Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated …
Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call. When the rewrite base is a plain string, the REQUEST_URI is appended to it, with no check that the path starts with a forward slash ('/'). When the rewrite base does not contain a path (which is the standard given in the SYNOPSIS), an attacker can create a reques…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-63077] In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible …
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-17191] An input validation vulnerability exists in an API component of the orchestrator. An authenticated u…
An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections. This issue was discovered internally by Arista and the company is not awa…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-66395] SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar p…
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with full Node.js access through insertAdjacentHTML rendering in an insecurely configured Electron renderer.
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2025-50455] SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Al…
SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-59550] Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions.
Unauthenticated SQL Injection in AWP Classifieds
nvdcriticovulnerabilidad CVSS 9.3 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-59538] Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions.
Unauthenticated SQL Injection in GamiPress
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-59549] Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-59527] Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.
Unauthenticated SQL Injection in MapSVG
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-59533] Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions.
Unauthenticated SQL Injection in Relevanssi Light
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-65879] Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret …
Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-61511] vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB…
vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style …
nvdcriticovulnerabilidad CVSS 9.8 NVD
A Crítico vulnerabilidad
27/07/2026
[CVE-2026-55971] Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache T…
Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
nvdcriticovulnerabilidad CVSS 9.8 NVD
A Crítico vulnerabilidad
27/07/2026
[CVE-2026-58023] Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift…
Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
nvdcriticovulnerabilidad CVSS 9.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
A Crítico vulnerabilidad
27/07/2026
[CVE-2026-58662] Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrif…
Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
nvdcriticovulnerabilidad CVSS 9.1 NVD
A Crítico vulnerabilidad
27/07/2026
[CVE-2026-48144] Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings…
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-64534] In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED be…
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally. However, if the command arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init() had returned false and percpu_ref_tryget_liv…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-64535] In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF wh…
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() — which p…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-13597] The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its …
The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the login code, and redeem it through an unauthenticated AJAX action to log in as that user, including an a…
nvdcriticovulnerabilidad CVSS 9.1 NVD