Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,181
Total alertas
4701
Críticas
16892
Altas
8
Ransomware
1055
Esta semana
RSS
Alta × cwe-918 × Limpiar todo ×
M Alto vulnerabilidad
07/07/2026
[CVE-2026-59707] LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/ap…
LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to gallery.GetGalleryConfigFromURLWithContext without proper validation, enabling attackers to force the server to issue HTTP GET requests to private and loopback ranges w…
nvdaltovulnerabilidad CVSS 8.6 NVD
K Alto vulnerabilidad
06/07/2026
[CVE-2026-57573] Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API serv…
Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server applied its SSRF destination check on the non-streaming /crawl path but not on the streaming path. handle_stream_crawl_request passed seed URLs straight to the crawler with no destination validation, allowing a remote unauthenticated client to call POST /crawl/stream or POST /crawl with crawler_c…
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
06/07/2026
[CVE-2025-53828] SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronizatio…
SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronization, and sharing application ownCloud Classic. In SharePoint for ownCloud prior to version 0.4.1, which corresponds to ownCloud 10 prior to 10.15.3, an attacker with administrative privileges can use a SSRF vulnerability in the SharePoint app to execute arbitrary code on the system. Upgrade ownCloud 1…
nvdaltovulnerabilidad CVSS 8.5 NVD
S Alto vulnerabilidad
06/07/2026
[CVE-2026-44937] Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.1…
Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by remote attackers to cause a denial of service or a downgrade attack on other repositories on the system.
nvdaltovulnerabilidad CVSS 8.2 NVD
A Alto vulnerabilidad
06/07/2026
[CVE-2026-55994] Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side R…
Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Iggy component. The camel-iggy consumer mapped the user-headers of inbound Iggy messages into the Camel Exchange header map without applying any HeaderFilterStrategy (IggyFetchRecords copied the message user-headers straight into the Exchange).…
nvdaltovulnerabilidad CVSS 7.5 NVD
A Alto vulnerabilidad
06/07/2026
[CVE-2026-55993] Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side R…
Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Atmosphere Websocket Component. The camel-atmosphere-websocket consumer mapped inbound WebSocket query parameters into the Camel Exchange header map without applying any HeaderFilterStrategy (WebsocketConsumer.sendEventNotification() iterates t…
nvdaltovulnerabilidad CVSS 7.5 NVD
A Alto vulnerabilidad
06/07/2026
[CVE-2026-46726] Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side R…
Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Vertx Websocket component. The camel-vertx-websocket consumer mapped inbound WebSocket query and path parameters into the Camel Exchange header map without applying any HeaderFilterStrategy (VertxWebsocketConsumer.populateExchangeHeaders()). Be…
nvdaltovulnerabilidad CVSS 7.5 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
03/07/2026
[CVE-2026-57993] Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacke…
Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
03/07/2026
[CVE-2026-10055] In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker…
In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the HTTP request server-side, and returns the full response body to the caller. Because the destination URL is neither validated nor allowlisted, a remote attacker with access to the Theia service co…
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
02/07/2026
[CVE-2026-59095] LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows au…
LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service (importFromUrl) and topic cover update (fetchImageFromUrl) endpoints, which use the global fetch without the project's ssrf-safe-fetch wrapper. Attackers can target…
nvdaltovulnerabilidad CVSS 7.7 NVD
U Alto vulnerabilidad
02/07/2026
[CVE-2026-55113] A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vuln…
A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vulnerability found in UniFi Talk Application to execute a Denial of Service (DoS) attack and bypass authentication in certain UniFi Talk API endpoints.
nvdaltovulnerabilidad CVSS 7.5 NVD
U Alto vulnerabilidad
02/07/2026
[CVE-2026-54401] A malicious actor with access to the network and low privileges could exploit a Server-Side Request …
A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
02/07/2026
[CVE-2026-57348] Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions <= 3.0.4 versions.
Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
02/07/2026
[CVE-2026-14336] PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' …
PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py:139) instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer such as https://ci.eclipse.org@evil.host (userinfo trick) or https://ci.eclipse.org.evil.host (suffix trick) that satisfies the prefix…
nvdaltovulnerabilidad CVSS 8.2 NVD
N Alto vulnerabilidad
01/07/2026
[CVE-2026-24242] NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause server-side …
NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.
nvdaltovulnerabilidad CVSS 7.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
I Alto vulnerabilidad
30/06/2026
[CVE-2026-11714] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side re…
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled.
nvdaltovulnerabilidad CVSS 8.5 NVD
L Alto vulnerabilidad
30/06/2026
[CVE-2026-10546] IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in …
IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL component ( src/lfx/src/lfx/components/data_source/url.py ) due to a Time-of-Check/Time-of-Use (TOCTOU) race condition that can be exploited via DNS rebinding.
nvdaltovulnerabilidad CVSS 7.1 NVD
L Alto vulnerabilidad
30/06/2026
[CVE-2026-10564] IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSRe…
IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSReaderComponent in rss.py and SearXNG component in searxng.py make unvalidated HTTP requests to user-controlled URLs, bypassing SSRF protections introduced in version 1.9.3. An authenticated attacker can exploit this to access internal resources including cloud metadata services (AWS/Azure/GCP IMDS), …
nvdaltovulnerabilidad CVSS 8.2 NVD
I Alto vulnerabilidad
30/06/2026
[CVE-2026-11546] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side re…
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.
nvdaltovulnerabilidad CVSS 7.1 NVD
L Alto vulnerabilidad
30/06/2026
[CVE-2026-10129] IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass…
IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass vulnerability in the API Request component. An authenticated attacker with low-level privileges (flow author role) can bypass SSRF protections by enabling the follow_redirects parameter and supplying a public URL that redirects to internal/localhost addresses. The vulnerability exists because the a…
nvdaltovulnerabilidad CVSS 8.5 NVD