Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,181
Total alertas
4701
Críticas
16892
Altas
8
Ransomware
1052
Esta semana
RSS
Alta × 30 días × Limpiar todo ×
M Alto vulnerabilidad
11/09/2026
[CVE-2026-18579] The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'H…
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The n…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
11/09/2026
[CVE-2026-15462] The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields'…
The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX action in versions up to, and including, 1.4.2. This is due to the save_form_data() function passing attacker-controlled POST array keys unsanitized to $wpdb->insert(), which wraps column identifiers in backticks without escaping them, allowing …
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
11/09/2026
[CVE-2026-18561] The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'ad…
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in the getWhereString() function; when the parameter is supplied as an array, element zero is used verbati…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
11/09/2026
[CVE-2026-78130] strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certifi…
strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
11/09/2026
[CVE-2026-78132] strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parse…
strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
11/09/2026
[CVE-2026-78133] libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handlin…
libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
11/09/2026
[CVE-2026-78134] strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins bec…
strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity.
nvdaltovulnerabilidad CVSS 7.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
11/09/2026
[CVE-2026-77807] The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugi…
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the `user[name]` Parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
10/09/2026
[CVE-2026-84889] IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitra…
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
10/09/2026
[CVE-2026-86093] IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to…
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack buffer without bounds checking.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
10/09/2026
[CVE-2026-87958] IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where …
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
10/09/2026
[CVE-2026-81940] IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitra…
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
10/09/2026
[CVE-2026-81941] IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute …
IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
10/09/2026
[CVE-2026-82092] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain se…
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
10/09/2026
[CVE-2026-82095] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute a…
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
nvdaltovulnerabilidad CVSS 8.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
10/09/2026
[CVE-2026-82097] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute a…
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to a Server-Side Request Forgery (SSRF) vulnerability.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
10/09/2026
[CVE-2026-82098] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute a…
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
10/09/2026
[CVE-2026-82099] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute a…
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
10/09/2026
[CVE-2026-81213] IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information …
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs.
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
10/09/2026
[CVE-2026-81265] IBM Langflow OSS 1.0.0 through 1.11.5.
IBM Langflow OSS 1.0.0 through 1.11.5.
nvdaltovulnerabilidad CVSS 7.5 NVD