Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 2 horas
22,162
Total alertas
4698
Críticas
16876
Altas
8
Ransomware
1037
Esta semana
RSS
Alta × cwe-79 × Limpiar todo ×
M Alto vulnerabilidad
02/09/2026
[CVE-2026-12865] The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters be…
The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScrip…
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
02/09/2026
[CVE-2026-84695] BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload …
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.
nvdaltovulnerabilidad CVSS 8.7 NVD
M Alto vulnerabilidad
01/09/2026
[CVE-2026-84370] SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG …
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor eleme…
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
01/09/2026
Vulnerabilidad de XSS almacenado en LibreNMS 26.4.0 mediante integración Oxidized
LibreNMS versiones hasta 26.4.0 procesa sin sanitización campos JSON (nombre, IP, modelo, autor, mensaje de commit) desde la URL de integración Oxidized configurable por administrador, permitiendo inyección de XSS persistente. Un atacante que controle el servidor Oxidized puede ejecutar scripts maliciosos en el navegador de usuarios que accedan a la página de configuración de dispositivos. Esta vulnerabilidad afecta directamente a proveedores de servicios de red y administradores de infraestructura en LATAM que usan LibreNMS con Oxidized integrado.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
01/09/2026
Vulnerabilidad XSS almacenado alta en LibreNMS anterior a 26.3.1
LibreNMS versiones anteriores a 26.3.1 presentan una vulnerabilidad de cross-site scripting (XSS) almacenado en plantillas PHP legadas que procesan datos de SNMP y syslog sin validación. Un atacante que controle dispositivos de red monitoreados puede inyectar código JavaScript malicioso a través de descripciones de interfaces SNMP o campos de programas syslog, ejecutándose cuando usuarios autenticados acceden a las páginas afectadas. Esto afecta principalmente a empresas de telecom, ISPs y centros de datos en LATAM que utilizan LibreNMS para monitoreo de infraestructura.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
01/09/2026
[CVE-2026-19914] The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cu…
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_order' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected paylo…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
01/09/2026
[CVE-2026-19573] The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via …
The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
nvdaltovulnerabilidad CVSS 7.2 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
01/09/2026
[CVE-2026-19796] The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vul…
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter in all versions up to, and including, 5.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a …
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-82221] Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.
Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-82224] Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.
Unauthenticated Cross Site Scripting (XSS) in SliceWP
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-82229] Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.
Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81764] Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.
Unauthenticated Cross Site Scripting (XSS) in Email Essentials
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81765] Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.
Unauthenticated Cross Site Scripting (XSS) in Tailored Tools
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81768] Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.
Unauthenticated Cross Site Scripting (XSS) in Super Store Finder
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81291] Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.
Unauthenticated Cross Site Scripting (XSS) in Uncode
nvdaltovulnerabilidad CVSS 7.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81298] Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.
Unauthenticated Cross Site Scripting (XSS) in LeadConnector
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81290] Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.
Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
30/08/2026
[CVE-2026-82653] SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where u…
SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute in users' browsers when uninstalling packages or unlocking encrypted notebooks.
nvdaltovulnerabilidad CVSS 8.9 NVD
M Alto vulnerabilidad
30/08/2026
[CVE-2026-82654] SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, …
SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block.
nvdaltovulnerabilidad CVSS 8.9 NVD
M Alto vulnerabilidad
30/08/2026
[CVE-2026-82642] Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter H…
Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the contents of the srcdoc attribute on elements, treating it as an opaque string attribute…
nvdaltovulnerabilidad CVSS 8.8 NVD