Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 16 min
22,662
Total alertas
4794
Críticas
17221
Altas
8
Ransomware
1371
Esta semana
RSS
Vulnerabilidades × Limpiar todo ×
G Alto vulnerabilidad
24/06/2026
[CVE-2026-13038] Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote atta…
Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
24/06/2026
[CVE-2026-48793] Jellyfin is an open source self hosted media server. Prior to 10.11.10, a potential FFmpeg argument …
Jellyfin is an open source self hosted media server. Prior to 10.11.10, a potential FFmpeg argument injection vulnerability exists in the subtitle conversion code path. SubtitleEncoder.ConvertTextSubtitleToSrtInternal (SubtitleEncoder.cs, line 382) interpolates the subtitle file path into FFmpeg command-line arguments without calling EncodingUtils.NormalizePath(). On Linux, filenames can contain d…
nvdaltovulnerabilidad CVSS 8.8 NVD
G Crítico vulnerabilidad
24/06/2026
[CVE-2026-13028] Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacke…
Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
nvdcriticovulnerabilidad CVSS 9.6 NVD
G Alto vulnerabilidad
24/06/2026
[CVE-2026-13029] Use after free in Web Authentication in Google Chrome prior to 149.0.7827.197 allowed an attacker wh…
Use after free in Web Authentication in Google Chrome prior to 149.0.7827.197 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
nvdaltovulnerabilidad CVSS 7.5 NVD
G Alto vulnerabilidad
24/06/2026
[CVE-2026-13031] Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execut…
Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvdaltovulnerabilidad CVSS 8.8 NVD
G Crítico vulnerabilidad
24/06/2026
[CVE-2026-13032] Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacke…
Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
nvdcriticovulnerabilidad CVSS 9.6 NVD
G Alto vulnerabilidad
24/06/2026
[CVE-2026-13033] Out of bounds read and write in Blink>InterestGroups in Google Chrome prior to 149.0.7827.197 allowe…
Out of bounds read and write in Blink>InterestGroups in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
nvdaltovulnerabilidad CVSS 8.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
G Alto vulnerabilidad
24/06/2026
[CVE-2026-13035] Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote attacke…
Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a malicious peripheral. (Chromium security severity: High)
nvdaltovulnerabilidad CVSS 8.8 NVD
G Alto vulnerabilidad
24/06/2026
[CVE-2026-13036] Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execut…
Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvdaltovulnerabilidad CVSS 8.8 NVD
G Alto vulnerabilidad
24/06/2026
[CVE-2026-13037] Use after free in WebView in Google Chrome on Android prior to 149.0.7827.197 allowed a local attack…
Use after free in WebView in Google Chrome on Android prior to 149.0.7827.197 allowed a local attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
nvdaltovulnerabilidad CVSS 7.8 NVD
G Alto vulnerabilidad
24/06/2026
[CVE-2026-13025] Race in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromi…
Race in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvdaltovulnerabilidad CVSS 8.3 NVD
G Alto vulnerabilidad
24/06/2026
[CVE-2026-13026] Use after free in Digital Credentials in Google Chrome on Mac prior to 149.0.7827.197 allowed a remo…
Use after free in Digital Credentials in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvdaltovulnerabilidad CVSS 8.8 NVD
G Alto vulnerabilidad
24/06/2026
[CVE-2026-13027] Use after free in FileSystem in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to p…
Use after free in FileSystem in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
24/06/2026
[CVE-2026-54699] Warp is an agentic development environment. From 0.2024.03.12.08.02.stable_01 until 0.2026.05.06.15.…
Warp is an agentic development environment. From 0.2024.03.12.08.02.stable_01 until 0.2026.05.06.15.42.stable_01, Warp contains an OS command injection vulnerability in the WSL URL-opening fallback. When Warp is running under WSL and cannot open a URL through wslview, it falls back to a Windows command processor path. A URL controlled through terminal output can reach that fallback when the user o…
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
24/06/2026
[CVE-2026-48720] Warp is an agentic development environment. From 0.2025.03.05.08.02.stable_00 until 0.2026.05.06.15.…
Warp is an agentic development environment. From 0.2025.03.05.08.02.stable_00 until 0.2026.05.06.15.42.stable_01, Warp accepts non-inline `OSC 1337;File` payloads from terminal output and materialize the decoded payload as a local file without an additional confirmation step. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.
nvdaltovulnerabilidad CVSS 8.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
24/06/2026
[CVE-2026-48721] Warp is an agentic development environment. From 0.2025.10.08.08.12.stable_00 until 0.2026.05.06.15.…
Warp is an agentic development environment. From 0.2025.10.08.08.12.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command execution permission-check bypass in the default unsandboxed CLI agent profile. The CLI profile is non-interactive and relies on a command denylist as a safety boundary for commands that should require confirmation. Because command strings were checked before ca…
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
24/06/2026
[CVE-2026-48725] Warp is an agentic development environment. From 0.2021.04.25.23.05.stable_00 until 0.2026.05.06.15.…
Warp is an agentic development environment. From 0.2021.04.25.23.05.stable_00 until 0.2026.05.06.15.42.stable_01, Warp allows terminal output to request access to the local system clipboard. A malicious remote host, remote program, or other attacker-controlled terminal output source can trigger clipboard reads or writes without a separate confirmation step. This crosses the trust boundary between …
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
24/06/2026
[CVE-2026-48731] Warp is an agentic development environment. From 0.2024.02.20.08.01.stable_01 until 0.2026.05.06.15.…
Warp is an agentic development environment. From 0.2024.02.20.08.01.stable_01 until 0.2026.05.06.15.42.stable_01, Warp contains a command injection issue in the Linux external editor launcher. Warp expanded freedesktop .desktop Exec templates for affected editor integrations and executed the expanded command through a shell. A user who opens an attacker-controlled local file path through an affect…
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
24/06/2026
[CVE-2026-48732] Warp is an agentic development environment. From 0.2023.03.21.08.02.stable_00 until 0.2026.05.06.15.…
Warp is an agentic development environment. From 0.2023.03.21.08.02.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command injection issue in the legacy SSH background command path. Warp used the remote working directory reported by the session when building helper commands for SSH-backed metadata collection. A remote host, repository, or directory name controlled by an attacker cou…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
24/06/2026
[CVE-2026-49851] Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerabl…
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining stri…
nvdaltovulnerabilidad CVSS 7.5 NVD