Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
24,497
Total alertas
5005
Críticas
18787
Altas
8
Ransomware
2722
Esta semana
RSS
Vulnerabilidades × vulnerabilidad × Limpiar todo ×
M Alto vulnerabilidad
22/07/2026
[CVE-2026-13059] An authenticated user with low privileges may be able to perform unauthorized reads and writes on da…
An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Crítico vulnerabilidad
22/07/2026
[CVE-2026-16624] Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to…
Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords, by triggering webhook delivery.
nvdcriticovulnerabilidad CVSS 9.6 NVD
F Alto vulnerabilidad
22/07/2026
[CVE-2026-64832] FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware d…
FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame descripti…
nvdaltovulnerabilidad CVSS 8.8 NVD
F Alto vulnerabilidad
22/07/2026
[CVE-2026-64833] FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer …
FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF r…
nvdaltovulnerabilidad CVSS 7.1 NVD
F Alto vulnerabilidad
22/07/2026
[CVE-2026-64834] FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer wi…
FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than…
nvdaltovulnerabilidad CVSS 7.5 NVD
F Alto vulnerabilidad
22/07/2026
[CVE-2026-64835] FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX au…
FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses t…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
22/07/2026
[CVE-2026-16157] Duplicati v2.3.0.1 backup software gives Authenticated Users MODIFY permissions that propagate to al…
Duplicati v2.3.0.1 backup software gives Authenticated Users MODIFY permissions that propagate to all subdirectories. Installing the software outside of the Program Files directory, or on a custom path, creates a LocalSystem service running from a directory that any standard local user can write to. A standard local user can overwrite any DLL in the service directory. On service restart, the OS lo…
nvdaltovulnerabilidad CVSS 7.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
22/07/2026
[CVE-2026-65013] Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnera…
Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and chat.conversation.delete. Attackers can provide arbitrary projectId or conversationId values without authoriz…
nvdaltovulnerabilidad CVSS 8.8 NVD
F Alto vulnerabilidad
22/07/2026
[CVE-2026-64830] FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtit…
FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded wri…
nvdaltovulnerabilidad CVSS 8.8 NVD
F Alto vulnerabilidad
22/07/2026
[CVE-2026-64831] FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC …
FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decoder that allows remote attackers to overwrite return addresses and adjacent stack frames by supplying a crafted HEVC/H.265 bitstream. Attackers can embed a malicious vps_num_hrd_parameters value exceeding HEVC_MAX_SUB_LAYERS in any supported container format to overflow stack-allocated …
nvdaltovulnerabilidad CVSS 8.8 NVD
D Alto vulnerabilidad
22/07/2026
[CVE-2026-49499] Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of Incorrect Sec…
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of Incorrect Security Tokens vulnerability in the IAM. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
nvdaltovulnerabilidad CVSS 8.8 NVD
D Crítico vulnerabilidad
22/07/2026
[CVE-2026-46738] Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation …
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
nvdcriticovulnerabilidad CVSS 9.1 NVD
D Crítico vulnerabilidad
22/07/2026
[CVE-2026-40712] Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation …
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
nvdcriticovulnerabilidad CVSS 9.1 NVD
D Alto vulnerabilidad
22/07/2026
[CVE-2026-40714] Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation …
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Crítico vulnerabilidad
22/07/2026
[CVE-2026-16606] A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before v…
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
22/07/2026
[CVE-2026-16607] A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before v…
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for local privilege escalation to root of an already authenticated user on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
22/07/2026
[CVE-2026-48029] libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a he…
libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Crítico vulnerabilidad
22/07/2026
[CVE-2026-2395] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows SQL Injection. This issue affects No Code Platform: from 4.1.3 before 4.1.4.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
22/07/2026
[CVE-2026-13204] If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there e…
If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
22/07/2026
[CVE-2026-13321] The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outs…
The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
nvdaltovulnerabilidad CVSS 8.6 NVD