Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,113
Total alertas
4677
Críticas
16848
Altas
8
Ransomware
1019
Esta semana
RSS
Alta × cwe-502 × Limpiar todo ×
M Alto vulnerabilidad
11/08/2026
[CVE-2026-65665] Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex…
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
11/08/2026
[CVE-2026-65658] Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex…
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
11/08/2026
[CVE-2026-64901] Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex…
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
11/08/2026
[CVE-2026-63514] Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex…
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
11/08/2026
[CVE-2026-15555] A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicat…
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
07/08/2026
[CVE-2026-68772] ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component…
ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifact store to execute arbitrary code by planting a malicious pickle file. Attackers can replace a stored artifact.pkl file with a crafted cloudpickle payload containing a malicious __reduce__ method, which executes arbitrary system commands wh…
nvdaltovulnerabilidad CVSS 8.0 NVD
M Alto vulnerabilidad
07/08/2026
[CVE-2026-71559] Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an at…
Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory: from 0.16.0 before 1.5.0.  Users of other language implementations are not affected. Users are recommended to upgrade to version 1.5.0…
nvdaltovulnerabilidad CVSS 7.5 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
06/08/2026
[CVE-2026-65549] Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.
Author PHP Object Injection in Jeg Kit for Elementor
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
05/08/2026
[CVE-2026-71294] Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that m…
Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a `ci` POST parameter obtained via `cot_import('ci', 'P', 'TXT')` (trim-only sanitization) is passed to `unserialize(base64_decode($ci))` with no `allowed_classes` restriction, reachable by any member with write access to …
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
05/08/2026
[CVE-2026-71281] Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~1…
Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~163, and src/peft/tuners/lora/loraga.py line ~101) call torch.load() on config-specified cache/covariance files without weights_only=True, bypassing peft's own safe-loading wrapper used elsewhere in the codebase. Because torch.load() without weights_only=True performs full pickle deserializa…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
04/08/2026
[CVE-2026-47623] NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of un…
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to denial of service and data tampering.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
03/08/2026
[CVE-2026-18642] Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Ins…
Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
03/08/2026
Vulnerabilidad alta de deserialización en PRISMAproduction 6.5 y anteriores permite ejecución remota de código
Una vulnerabilidad de deserialización en PRISMAproduction versión 6.5 o inferior permite a atacantes ejecutar código arbitrario en sistemas afectados. Con puntuación CVSS 7.5, esta falla representa un riesgo significativo para infraestructuras empresariales en México y Latinoamérica que implementen esta solución en entornos de producción. La explotación no requiere interacción del usuario y puede comprometer la integridad y confidencialidad de datos altas.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
31/07/2026
[CVE-2026-12720] The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when i…
The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via another installed Kirki WordPress plugin before 6.0.13, , or an outdated WordPress v…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-11536] IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability i…
IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.
nvdaltovulnerabilidad CVSS 8.5 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
30/07/2026
[CVE-2026-57859] e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization h…
e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the user_prefs column. The e_array::unserialize() function in e107_handlers/core_functions.php performs only a prefix check for the string 'array' before passing the st…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-1360] The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versio…
The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unserialize_profile_field()` function using `@unserialize()` without the `allowed_classes` parameter on user-controlled XProfile field data. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject ar…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-58163] Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or cras…
Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-14974] IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute a…
IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.
nvdaltovulnerabilidad CVSS 8.1 NVD
J Alto vulnerabilidad
27/07/2026
[CVE-2026-65617] A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user t…
A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions.
nvdaltovulnerabilidad CVSS 8.8 NVD