Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 9 min
22,454
Total alertas
4765
Críticas
17048
Altas
8
Ransomware
1252
Esta semana
RSS
Alta × Limpiar todo ×
M Alto vulnerabilidad
23/09/2026
[CVE-2026-86064] Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-o…
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to ch…
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-84714] A flaw was found in the automation-controller input-validation guard sanitize_jinj…
A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior '}' or '%' character, so a Jinja expression containing an inner brace (for example an empty dict) is accep…
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-84683] A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of j…
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8 hyperlink sequence in the output is expanded into an HTML anchor whose href is not scheme- filtered or esca…
nvdaltovulnerabilidad CVSS 8.7 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-84691] A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that f…
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an administrator-controlled Python format-string template that is rendered with a live user object as an argument. Because Python string formatting permits attribute and item traversal on its arguments, an administrator can craft a template that w…
nvdaltovulnerabilidad CVSS 8.7 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-84706] A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type …
A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list (an ANSIBLE_* prefix check plus a fixed ENV_BLOCKLIST) that omits process-hijacking loader variables such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP and GIT_SSH_COMMAND. Combined with the credential file inj…
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-96541] A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can o…
A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is clos…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95603] Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions.
Shop manager PHP Object Injection in Reycob Product Import Export
nvdaltovulnerabilidad CVSS 7.2 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95604] Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.
Unauthenticated Broken Access Control in Loops & Logic
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95528] Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions…
Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95529] Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95590] Subscriber SQL Injection in Tainacan <= 1.2.0 versions.
Subscriber SQL Injection in Tainacan
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95593] Editor SQL Injection in Ultimeter <= 3.0.8 versions.
Editor SQL Injection in Ultimeter
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95515] Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95522] Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.
Shop manager SQL Injection in Easy Digital Downloads
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95513] Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita…
Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita
nvdaltovulnerabilidad CVSS 7.5 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
23/09/2026
[CVE-2026-94487] Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-94174] Administrator SQL Injection in Email Log <= 2.63 versions.
Administrator SQL Injection in Email Log
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-94176] Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-94179] Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.
Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-94181] An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the brows…
An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a element that triggers requestFullscreen without displaying the fullscreen notification.
nvdaltovulnerabilidad CVSS 7.4 NVD