Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,181
Total alertas
4701
Críticas
16892
Altas
8
Ransomware
1055
Esta semana
RSS
Alta × cwe-502 × Limpiar todo ×
M Alto vulnerabilidad
22/06/2026
[CVE-2025-71339] Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran._eval_length gadget in pickle _…
Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran._eval_length gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded by victims who trust Picklescan's safety validation.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
22/06/2026
[CVE-2025-71344] picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_p…
picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_pip built-in function when scanning pickle files, allowing attackers to execute arbitrary code. Malicious pickle files embedding ensurepip._run_pip calls in __reduce__ methods bypass picklescan detection and achieve remote code execution upon pickle.load() invocation.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
22/06/2026
[CVE-2025-71358] picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.Au…
picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.get_entity function in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims using pickle.load().
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
21/06/2026
[CVE-2025-71357] picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterp…
picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
21/06/2026
[CVE-2025-71378] picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce method…
picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded via pickle.load().
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
21/06/2026
[CVE-2025-71348] picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_modu…
picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers can craft pickle files embedding arbitrary code that evades detection but executes during pickle.load, enabling remote code execution in supply chain attacks.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
19/06/2026
[CVE-2026-49286] PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version …
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` guarded the output filename against the `phar://` stream wrapper with a case-sensitive blacklist. PHP stream wrappers are case-insensitive, so `PHAR://`, `Phar://`, etc. bypass the check and reach `fileExists()` (`file_exists()`) in `prepareOutput()`. On PHP 7 (wh…
nvdaltovulnerabilidad CVSS 8.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
O Alto vulnerabilidad
18/06/2026
[CVE-2025-27511] GeoServer is an open source server that allows users to share and edit geospatial data. Prior to ver…
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
17/06/2026
[CVE-2026-40733] Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions.
Unauthenticated PHP Object Injection in ShiftUp
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
17/06/2026
[CVE-2026-40738] Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions.
Unauthenticated PHP Object Injection in Eldon
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
17/06/2026
[CVE-2026-40752] Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions.
Unauthenticated PHP Object Injection in Manufaktur Solutions
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
17/06/2026
[CVE-2026-40756] Unauthenticated PHP Object Injection in Zoya <= 1.4 versions.
Unauthenticated PHP Object Injection in Zoya
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
17/06/2026
[CVE-2026-40757] Unauthenticated PHP Object Injection in Château <= 1.2.1 versions.
Unauthenticated PHP Object Injection in Château
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
17/06/2026
[CVE-2026-39556] Unauthenticated PHP Object Injection in Konsept <= 1.9 versions.
Unauthenticated PHP Object Injection in Konsept
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
17/06/2026
[CVE-2026-39560] Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.
Unauthenticated PHP Object Injection in Hiroshi
nvdaltovulnerabilidad CVSS 8.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
17/06/2026
[CVE-2026-39576] Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions.
Unauthenticated PHP Object Injection in SingleMalt
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
17/06/2026
[CVE-2026-39442] Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions.
Unauthenticated PHP Object Injection in PressMart
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
17/06/2026
[CVE-2026-39445] Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.
Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
17/06/2026
[CVE-2025-69130] Subscriber PHP Object Injection in Entrepreneur - Booking for Small Businesses WordPress Theme <= 3.…
Subscriber PHP Object Injection in Entrepreneur - Booking for Small Businesses WordPress Theme
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
17/06/2026
[CVE-2026-40755] Unauthenticated PHP Object Injection in TechLink <= 1.3 versions.
Unauthenticated PHP Object Injection in TechLink
nvdaltovulnerabilidad CVSS 8.1 NVD