Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 1 hora
Buscando: "Apache" — 217 resultados ✕ Limpiar búsqueda
22,093
Total alertas
4671
Críticas
16834
Altas
8
Ransomware
1003
Esta semana
RSS
Alta × Limpiar todo ×
A Alto vulnerabilidad
10/06/2026
[CVE-2026-47342] A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to o…
A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges This issue affects Apache OFBiz: before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
10/06/2026
[CVE-2026-45569] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, ommit d4d10006 ("Expand validation to block .. in config_file_name and configver for improved security") added a line in app/modules/config/config.py:462. This is tuple-membership, not substring containment — '..' in (a, b, c) evaluates to True only if any of a, b, c is equal to th…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
10/06/2026
[CVE-2026-45565] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, EscapedString (app/modules/roxywi/class_models.py:16-30) is the centralised Pydantic validator used on dozens of fields including SSH credential name, username, description, etc. Its if/elif/elif/else flow returns the metacharacter-stripped value without also enforcing the .. block…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
10/06/2026
[CVE-2026-45567] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, there is an authentication bypass vulnerability via 'api' substring in URL + unauthenticated /api/gpt. At time of publication, there are no publicly available patches.
nvdaltovulnerabilidad CVSS 8.3 NVD
A Alto vulnerabilidad
10/06/2026
[CVE-2026-25700] Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affect…
Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired. Users are recommended to upgrade to version 2.0.1, which fixe…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
10/06/2026
[CVE-2026-45564] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /config/versions////save interpolates the URL-path configver parameter directly into a config-version path that ends up at os.system(f"dos2unix -q {cfg}"). configver is not run through EscapedString (Pydantic doesn't validate path segments declar…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
10/06/2026
[CVE-2026-45549] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, agent_action (app/routes/smon/agent_routes.py:166-179) has decorators @bp.post('/agent/action/') and @jwt_required() only — no role check, no group ownership check on the server_ip form field. Any authenticated user, including role 4 (guest), can start, stop, or restart the…
nvdaltovulnerabilidad CVSS 8.5 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
V Alto vulnerabilidad
10/06/2026
[CVE-2026-41732] JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning t…
JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default allow-list. Affected versions: Spring for Apache Pulsar 2.0.0 through 2.0.5; 1.2.0 through 1.2.17; 1.1.0 t…
nvdaltovulnerabilidad CVSS 8.1 NVD
A Alto vulnerabilidad
08/06/2026
[CVE-2026-49975] Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to …
Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.
nvdaltovulnerabilidad CVSS 7.5 NVD
A Alto vulnerabilidad
08/06/2026
[CVE-2026-48913] Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already ex…
Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.
nvdaltovulnerabilidad CVSS 7.3 NVD
A Alto vulnerabilidad
08/06/2026
[CVE-2026-44185] Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker contr…
Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
nvdaltovulnerabilidad CVSS 7.3 NVD
A Alto vulnerabilidad
08/06/2026
[CVE-2026-44186] Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in …
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server. This issue affects undefined: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
nvdaltovulnerabilidad CVSS 7.3 NVD
A Alto vulnerabilidad
08/06/2026
[CVE-2026-42536] Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and…
Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
nvdaltovulnerabilidad CVSS 7.5 NVD
A Alto vulnerabilidad
08/06/2026
[CVE-2026-34355] A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an …
A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.
nvdaltovulnerabilidad CVSS 7.5 NVD
A Alto vulnerabilidad
08/06/2026
[CVE-2026-34356] Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and Pr…
Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie* This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
nvdaltovulnerabilidad CVSS 7.5 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
A Alto vulnerabilidad
08/06/2026
[CVE-2026-47430] ## Summary The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WK…
## Summary The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560–574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose `id` field is a guessable or enumerated cal…
nvdaltovulnerabilidad CVSS 7.5 NVD
A Alto vulnerabilidad KEV
16/04/2026
Vulnerabilidad crítica en Apache ActiveMQ bajo explotación activa
Apache ha confirmado explotación activa de CVE-2026-34197 en Apache ActiveMQ. CISA ha establecido el 30 de abril de 2026 como fecha límite para remediar la vulnerabilidad en sistemas federales estadounidenses. Aunque no se ha detectado uso en campañas de ransomware conocidas, organizaciones en México y LATAM deben considerar este plazo como referencia de urgencia máxima dado el estado de explotación activa.
apacheexplotación activavulnerabilidad CISA KEV