Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,181
Total alertas
4701
Críticas
16892
Altas
8
Ransomware
1055
Esta semana
RSS
Vulnerabilidades × cwe-200 × Limpiar todo ×
M Alto vulnerabilidad
10/08/2026
[CVE-2026-18470] The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset requ…
The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including administrators'.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
10/08/2026
[CVE-2026-18946] The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copyin…
The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
10/08/2026
[CVE-2026-17022] The Salon Booking System WordPress plugin through 10.30.33 does not properly validate a booking's o…
The Salon Booking System WordPress plugin through 10.30.33 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplying a sequential booking identifier.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
10/08/2026
[CVE-2026-17541] The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST…
The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
10/08/2026
[CVE-2026-17542] The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its f…
The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
10/08/2026
[CVE-2026-14206] The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the e…
The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data (name, email, phone, address) stored in form drafts.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
07/08/2026
[CVE-2026-14943] The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress p…
The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read otherwise-protected content and account identifiers via the REST API. This re-introduces a previously-fixed i…
nvdaltovulnerabilidad CVSS 7.5 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
06/08/2026
[CVE-2026-48080] OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl…
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the `GET /api/tenants/{id}` endpoint returns the full tenant record to any authenticated `TENANT_ADMIN` of that tenant, including the `databaseUrl` field. This field contains the live PostgreSQL connection string the application uses to connect to that tenant's databa…
nvdaltovulnerabilidad CVSS 8.0 NVD
M Alto vulnerabilidad
06/08/2026
[CVE-2026-45378] Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0…
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verification_attachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to download the scanned document without an authenticated Decidim session until the signature expires. Ver…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-54489] Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a…
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This vulnerability is considered critical as it allows an unauthenticated attacker to obtain active session crede…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Alto vulnerabilidad
06/08/2026
[CVE-2026-18050] The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST r…
The Events Manager WordPress plugin before 7.4 does not perform any authorization check on a REST route that serves temporarily stored file uploads, allowing unauthenticated users to retrieve another user's in-progress upload when its temporary identifier is known. The identifier is high-entropy, is disclosed only to the uploader, and the file is removed on submission or by a scheduled cleanup, s…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
06/08/2026
[CVE-2026-13153] The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its…
The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response, allowing unauthenticated users to read the lifetime number of units sold for any published product.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
06/08/2026
[CVE-2026-13154] The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-suppl…
The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as non-public.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
05/08/2026
Vulnerabilidad alta en Eclipse Theia 1.73.1 expone acceso no autorizado a archivos del servidor
Eclipse Theia versiones hasta 1.73.1 contienen una vulnerabilidad que permite a atacantes descargar archivos arbitrarios del servidor sin restricción de directorio workspace. El backend `@theia/filesystem` no valida correctamente las rutas URI en endpoints HTTP, afectando especialmente despliegues en navegador donde la validación de tokens es insuficiente. Empresas LATAM usando Theia como IDE en la nube corren riesgo de exposición de fuentes, configuraciones sensibles y datos de negocio.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
05/08/2026
[CVE-2026-16603] The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection o…
The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unauthenticated users to read the full content, title, and excerpt of category-locked posts through the core REST API.
nvdaltovulnerabilidad CVSS 7.5 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
05/08/2026
[CVE-2026-16604] The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public p…
The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the password, allowing unauthenticated users to recover the protected content without knowing the password.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
05/08/2026
[CVE-2026-16602] The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning po…
The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST endpoint, allowing unauthenticated users to disclose the content of non-public (draft, private, and pending) posts on sites that have a captcha provider configured.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
02/08/2026
[CVE-2026-67357] ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_serve…
ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and achieve full server compromise.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
01/08/2026
Vulnerabilidad alta en ArcadeDB: exposición de token de clúster en versiones anteriores a 26.7.2
ArcadeDB versiones anteriores a 26.7.2 no redactan correctamente el token de clúster en el endpoint GET /api/v1/server, permitiendo a usuarios autenticados obtener el valor arcadedb.ha.clusterToken en texto plano. Los atacantes pueden usar el token filtrado con headers X-ArcadeDB-Cluster-Token y X-ArcadeDB-Forwarded-User para suplantación de root y ejecutar acciones administrativas no autorizadas, incluyendo creación de usuarios y operaciones de base de datos.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
01/08/2026
Vulnerabilidad alta en GitPython anterior a 3.1.52 permite filtración de variables de entorno
GitPython versiones anteriores a 3.1.52 contiene una vulnerabilidad que permite a un atacante exfiltrar variables de entorno del sistema mediante URLs malformadas en la función Repo.clone_from(). La función Git.polish_url() expande tokens $NAME o ${NAME} incrustados en URLs de repositorios, exponiendo credenciales, tokens de API y datos sensibles del proceso anfitrión. Afecta principalmente a aplicaciones que clonan repositorios Git con URLs controladas por usuarios no confiables.
nvdaltovulnerabilidad CVSS 7.5 NVD