Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,113
Total alertas
4677
Críticas
16848
Altas
8
Ransomware
1019
Esta semana
RSS
Alta × cwe-79 × Limpiar todo ×
M Alto vulnerabilidad
25/09/2026
[CVE-2026-84279] The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'output_format' parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires …
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
25/09/2026
[CVE-2026-97735] ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php)…
ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive over SMTP from arbitrary senders.
nvdaltovulnerabilidad CVSS 8.0 NVD
M Alto vulnerabilidad
24/09/2026
[CVE-2026-61823] code16 Sharp is a Laravel-based framework for building content-management and administrative interfa…
code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the `srcdoc` attribute on iframe elements. Although markup inside `srcdoc` is HTML-encoded during sanitization, browsers decode attribute entities before interpr…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
24/09/2026
[CVE-2026-61825] code16 Sharp is a Laravel-based framework for building content-management and administrative interfa…
code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in `SharpEditorFormField`: attacker-controlled content bearing the `data-html-content` attribute can bypass HTML sanitization and preserve executable markup, which may execute when another user views the stored content. …
nvdaltovulnerabilidad CVSS 8.7 NVD
M Alto vulnerabilidad
24/09/2026
[CVE-2026-57440] The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and variou…
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escap…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
24/09/2026
[CVE-2026-91122] Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0…
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting privileges could store the crafted placeholder in a post. When another user opened the post and clicked the vi…
nvdaltovulnerabilidad CVSS 8.7 NVD
M Alto vulnerabilidad
24/09/2026
[CVE-2026-62368] Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.crea…
Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page associated with the fieldset, the stored markup executes on page load in that user's Snipe-IT session.…
nvdaltovulnerabilidad CVSS 8.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
24/09/2026
[CVE-2026-63498] Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint G…
Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with the inline=true parameter. The app/Http/Controllers/Api/UploadedFilesController.php show() path does not apply the safe-inline allowlist use…
nvdaltovulnerabilidad CVSS 8.7 NVD
M Alto vulnerabilidad
24/09/2026
[CVE-2026-56736] phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in…
phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user (or low-privileged registered user) to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry. This leads to admin account takeover via session theft. The vulnerability…
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-84683] A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of j…
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8 hyperlink sequence in the output is expanded into an HTML anchor whose href is not scheme- filtered or esca…
nvdaltovulnerabilidad CVSS 8.7 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95528] Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions…
Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95529] Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95515] Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-94176] Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-94179] Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.
Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button
nvdaltovulnerabilidad CVSS 7.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
23/09/2026
[CVE-2026-93622] Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.
Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-93774] Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-93526] Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.
Unauthenticated Cross Site Scripting (XSS) in Event Tickets
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-77394] OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or mor…
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator's …
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
23/09/2026
Vulnerabilidad alta en Tauri: omisión de CSP permite ejecución arbitraria de scripts
Tauri contiene una falla en su mecanismo de Content Security Policy (CSP) que permite a atacantes ejecutar scripts arbitrarios al incluir esquemas data: o blob: en la directiva script-src, anulando la protección del nonce aleatorio. Aplicaciones Tauri en México y LATAM que procesen contenido dinámico están expuestas a inyección de código y compromiso de datos sensibles.
nvdaltovulnerabilidad CVSS 8.3 NVD