Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 6 horas
26,491
Total alertas
5341
Críticas
20263
Altas
8
Ransomware
1672
Esta semana
RSS
M Alto vulnerabilidad
30/09/2026
[CVE-2026-94076] Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-94078] Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Site Reviews
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-94081] Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.
Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-93514] Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.
Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-93621] Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.
Unauthenticated SQL Injection in WP Data Access
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-93624] Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.
Shop manager PHP Object Injection in Music Player for WooCommerce
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-93651] Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.
Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce
nvdaltovulnerabilidad CVSS 7.2 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
30/09/2026
[CVE-2026-93770] Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Statistics
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-93771] Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.
Shop manager PHP Object Injection in Cost of Goods for WooCommerce
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-93512] Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.
Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-92121] In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves…
In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and SignedElements for the rest of the message. A policy requiring the SOAP Body to be signed is then satisfied eve…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-62085] Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.
Administrator SQL Injection in WP Activity Log
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-27371] Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.
Unauthenticated Cross Site Scripting (XSS) in WPFunnels
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-102385] Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-102395] Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.
Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps
nvdaltovulnerabilidad CVSS 7.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
30/09/2026
[CVE-2026-102396] Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.
Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-102398] Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-100507] Unauthenticated Cross Site Scripting (XSS) in If-So Dynamic Content Personalization <= 1.10.1 versio…
Unauthenticated Cross Site Scripting (XSS) in If-So Dynamic Content Personalization
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
30/09/2026
Vulnerabilidad alta en CRI-O permite escape de contenedores mediante corrupción de metadatos
Una falla en la persistencia del estado sandbox de CRI-O permite que metadatos manipulados sobrescriban la información de control interno, que luego se carga como confiable tras un reinicio. Esto habilita que contenedores expongyan recursos del host, facilitando escapes. Afecta plataformas Kubernetes en producción en LATAM que dependan de CRI-O como runtime de contenedores.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-85532] Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. T…
Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum length of 512 bytes, and a maximum offset of 4096 bytes. Users are recommended to upgrade to versions 4.0.2…
nvdaltovulnerabilidad CVSS 7.5 NVD