Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,434
Total alertas
3054
Críticas
10108
Altas
8
Ransomware
1778
Esta semana
RSS
M Alto vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-66610] Unauthenticated Cross Site Scripting (XSS) in Urna <= 2.6.2 versions.
Unauthenticated Cross Site Scripting (XSS) in Urna
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-66623] Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.
Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-66584] Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions.
Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-66599] Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.
Unauthenticated Cross Site Scripting (XSS) in WPComplete
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-32476] Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions.
Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO)
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-28162] Unauthenticated Cross Site Scripting (XSS) in Events Made Easy <= 3.2.5 versions.
Unauthenticated Cross Site Scripting (XSS) in Events Made Easy
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-28166] Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions.
Unauthenticated Cross Site Scripting (XSS) in Tourmaster
nvdaltovulnerabilidad CVSS 7.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad Nuevo
Hace 3 horas
[CVE-2026-78213] Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authen…
Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content.
nvdaltovulnerabilidad CVSS 8.7 NVD
M Crítico vulnerabilidad Nuevo
Hace 17 horas
[CVE-2026-8445] justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters…
justhtml versions are preserved, so untrusted input that is safe in to_html() — including entity-decoded text (e.g. &lt;script&gt;) or t…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
Hace 1 día
[CVE-2026-77115] Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into pop…
Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
Hace 2 días
Vulnerabilidad XSS Reflejado alta en Combodo iTop 3.2.2 y anteriores
Combodo iTop, herramienta de gestión de servicios IT ampliamente utilizada en empresas LATAM, contiene una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en el API de búsqueda de claves foráneas con puntuación CVSS 8.8. Un atacante puede inyectar código malicioso en parámetros de búsqueda para ejecutar scripts en navegadores de usuarios administrativos, comprometiendo credenciales y acceso a datos altas de infraestructura IT. La vulnerabilidad afecta versiones anteriores a 3.2.3.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
Hace 2 días
Vulnerabilidad alta en OpenSearch Dashboards permite ejecución de código JavaScript arbitrario
Una validación deficiente en el plugin dashboards-observability de OpenSearch Dashboards permite a usuarios autenticados con permisos de escritura ejecutar código JavaScript malicioso en sesiones de otros usuarios mediante carga de activos comprometidos. Esta vulnerabilidad afecta directamente plataformas de observabilidad y análisis de logs ampliamente usadas en infraestructuras cloud de LATAM, exponiendo datos sensibles de infraestructura, bases de datos y aplicaciones altas.
nvdaltovulnerabilidad CVSS 8.7 NVD
M Alto vulnerabilidad
Hace 2 días
[CVE-2026-61824] Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt a…
Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without the main pipeline's DOM-based sanitization. The affected paths include src/extractors/x-article.ts, src/extractors/substack.ts,…
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
Hace 2 días
[CVE-2026-63135] YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS …
YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder…
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
Hace 2 días
[CVE-2026-30890] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S…
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script. This issue has been fixed in version 3.2.3.
nvdaltovulnerabilidad CVSS 8.0 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
Hace 2 días
[CVE-2026-31803] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected …
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3.
nvdaltovulnerabilidad CVSS 8.0 NVD
M Alto vulnerabilidad
Hace 2 días
[CVE-2026-31880] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S…
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has been fixed in version 3.2.3.
nvdaltovulnerabilidad CVSS 8.0 NVD
M Alto vulnerabilidad
Hace 2 días
[CVE-2026-30826] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S…
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3.
nvdaltovulnerabilidad CVSS 8.0 NVD
M Alto vulnerabilidad
Hace 2 días
[CVE-2026-30865] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S…
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
Hace 2 días
[CVE-2026-30819] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-S…
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting (XSS) vulnerability in its dashboard revert functionality with the parameter dashboard_id in /pages/ajax.render.php. This issue has been fixed in version 3.2.3.
nvdaltovulnerabilidad CVSS 7.3 NVD