Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,419
Total alertas
4761
Críticas
17027
Altas
8
Ransomware
1260
Esta semana
RSS
Alta × 30 días × Limpiar todo ×
M Alto vulnerabilidad
17/09/2026
[CVE-2026-88904] The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST rou…
The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby escalate their privileges.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-91014] The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise an…
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into following a crafted link (reflected XSS).
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-87786] The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at che…
The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-88792] The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in…
The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2025-15697] The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in …
The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-85128] The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role reques…
The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any role, including administrator, and to be granted it once the request is approved. Exploitation requires the Choose User Role at Registration WordPress plugin before 1.3.3's role selec…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-85130] The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a p…
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated users to run arbitrary JavaScript in the session of an administrator who interacts with the logged entry. Only multisite installations are affected.
nvdaltovulnerabilidad CVSS 8.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
17/09/2026
[CVE-2026-87935] The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to…
The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler function. This is due to missing authorization and file type validation in the admin_request_handler function, which is reachable unauthenticated via is_admin() returning true for /wp-admin/admin-post.php. This makes it possible for unauthenticated…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-25281] Transient DOS when processing large or numerous request buffers without sufficient memory allocation…
Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation.
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-25282] Transient DOS when processing unverified data from a neighboring system causes out of bound memory a…
Transient DOS when processing unverified data from a neighboring system causes out of bound memory access.
nvdaltovulnerabilidad CVSS 7.9 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-25283] Memory Corruption when copying unverified data from an external source exceeds the allocated buffer …
Memory Corruption when copying unverified data from an external source exceeds the allocated buffer size.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-25284] Information Disclosure when a pointer is reused after being deallocated.
Information Disclosure when a pointer is reused after being deallocated.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-25290] Memory Corruption when validating large data buffers from external sources using addition to check b…
Memory Corruption when validating large data buffers from external sources using addition to check buffer length.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-25294] Transient DOS while parsing frame during channel usage.
Transient DOS while parsing frame during channel usage.
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-24075] Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handle…
Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.
nvdaltovulnerabilidad CVSS 7.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
17/09/2026
[CVE-2026-24081] Transient DOS when processing a channel map with insufficient used channels and adaptive frequency h…
Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-25275] Transient DOS when processing authentication frames with invalid FILS information element header len…
Transient DOS when processing authentication frames with invalid FILS information element header lengths.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-25278] Memory Corruption when processing I2C transfer requests due to a race condition between memory alloc…
Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-25280] Memory corruption when processing escape handling flow with insufficient user buffer sizes.
Memory corruption when processing escape handling flow with insufficient user buffer sizes.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-24073] Memory corruption when processing decode statistics due to insufficient validation of offset against…
Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.
nvdaltovulnerabilidad CVSS 7.8 NVD