Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Multiple Vendors" — 17322 resultados ✕ Limpiar búsqueda
22,841
Total alertas
4833
Críticas
17354
Altas
8
Ransomware
1396
Esta semana
RSS
Vulnerabilidades × Limpiar todo ×
M Crítico vulnerabilidad
29/07/2026
[CVE-2025-10656] The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vuln…
The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.37 vi the user_filter function. This makes it possible for unauthenticated attackers to create admin accounts.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-64556] In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups …
In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-level events, this removes the event from the context with DETACH_EXIT only. This can leave inconsistent group state when a removed event is a group leader and the group contains siblings w…
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-64557] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after…
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after release_sock(parent). Once the parent lock is dropped the newly enqueued child socket sk is reachable via the accept queue, so another task can accept and free it before the callback dereference…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-65324] Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, le…
Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-13425] The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array For…
The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by una…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-58151] Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and …
Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-58153] Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked frami…
Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
nvdaltovulnerabilidad CVSS 8.3 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
29/07/2026
[CVE-2026-58154] Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP heade…
Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
nvdaltovulnerabilidad CVSS 8.9 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-58155] Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling,…
Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-41920] Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic S…
Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-57834] Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affect…
Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-58150] Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade reque…
Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-18191] VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated…
VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden function to obtain the administrator credentials of the device.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-22068] Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apach…
Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-24033] Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Ap…
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
nvdaltovulnerabilidad CVSS 7.2 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-33267] Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic…
Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-63229] A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated att…
A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-63230] A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticat…
A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-63231] A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker t…
A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Crítico vulnerabilidad
29/07/2026
[CVE-2026-63232] A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated att…
A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.
nvdcriticovulnerabilidad CVSS 9.9 NVD