Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
14,330
Total alertas
3266
Críticas
10791
Altas
8
Ransomware
1034
Esta semana
RSS
Alta × alto × Limpiar todo ×
M Alto vulnerabilidad
30/07/2026
[CVE-2026-18360] The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site sc…
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-18361] The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site sc…
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function.
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-16969] The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site sc…
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-44106] A privilege escalation vulnerability in the init-script for user-applications allows a low-privilege…
A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-44107] A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefor…
A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the port that CharxModbusServer is listening, an unauthenticated attacker can perform a Denial-of-Service attack.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-44099] A privilege escalation vulnerability in the system configuration allows a low-privileged local user …
A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-44093] A local privilege escalation vulnerability in the init-script for user-applications allows a low-pri…
A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
nvdaltovulnerabilidad CVSS 7.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
30/07/2026
[CVE-2026-44094] An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with …
An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Charging could be interrupted.
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-44095] A privilege escalation vulnerability in a script used for network configuration allows a low-privile…
A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-44096] A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary …
A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-44097] A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endp…
A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-44098] This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via …
This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted.
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-58043] A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree pr…
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-47858] Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes t…
Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier
nvdaltovulnerabilidad CVSS 8.0 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-47873] The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of th…
The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) rather than restricting them to loopback. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier
nvdaltovulnerabilidad CVSS 8.0 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
30/07/2026
[CVE-2026-47882] When enabling Spring Boot DevTools support for a remote application target (for example a Docker con…
When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret was generated using a non-cryptographic pseudo-random number generator rather than a cryptographically…
nvdaltovulnerabilidad CVSS 8.3 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-16524] A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the n…
A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-16526] A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with in…
A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-16527] An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP…
An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-16529] A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network pack…
A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.
nvdaltovulnerabilidad CVSS 7.5 NVD