Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,181
Total alertas
4701
Críticas
16892
Altas
8
Ransomware
1054
Esta semana
RSS
Alta × cwe-79 × Limpiar todo ×
M Alto vulnerabilidad
20/08/2026
XSS no autenticado en NotificationX Pro versiones <= 3.1.4 (CVSS 7.1)
Se ha identificado una vulnerabilidad de Cross Site Scripting (XSS) no autenticado en NotificationX Pro hasta la versión 3.1.4, que permite a atacantes inyectar código malicioso sin credenciales. Esta falla afecta directamente a plataformas de comercio electrónico y sitios web en México y Latinoamérica que utilizan este plugin para notificaciones. El acceso no autorizado al código del cliente expone datos de usuarios y sesiones activas.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66615] Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.
Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66616] Unauthenticated Cross Site Scripting (XSS) in Form Maker by 10Web <= 1.15.46 versions.
Unauthenticated Cross Site Scripting (XSS) in Form Maker by 10Web
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66673] Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.
Unauthenticated Cross Site Scripting (XSS) in Flatastic
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66604] Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.
Unauthenticated Cross Site Scripting (XSS) in GeoDirectory
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66605] Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products…
Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66606] Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.
Unauthenticated Cross Site Scripting (XSS) in SmartSMTP
nvdaltovulnerabilidad CVSS 7.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66607] Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.
Unauthenticated Cross Site Scripting (XSS) in Advance Product Search
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66611] Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.
Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66612] Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions.
Unauthenticated Cross Site Scripting (XSS) in Aora
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66614] Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.
Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66597] Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.
Unauthenticated Cross Site Scripting (XSS) in wpDataTables
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66598] Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.
Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66581] Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.
Unauthenticated Cross Site Scripting (XSS) in JetEngine
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66582] Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.
Unauthenticated Cross Site Scripting (XSS) in TranslatePress
nvdaltovulnerabilidad CVSS 7.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66590] Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.
Unauthenticated Cross Site Scripting (XSS) in Tagembed
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-76333] In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power"…
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action with a crafted Uniform Resource Locator (URL). When another authenticated user selects the stored action from Event Actions and selects Continue, attacker-controlled JavaScript runs in the browser of that user. This could expose data or act…
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-76325] In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power"…
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious ui-tour knowledge object that matches an auto-tour page name and share the object at the app level. The object can execute arbitrary JavaScript in the browser of another authenticated user who visits a standard Splunk Web page. The JavaScript could expose all rel…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-68900] Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip() in client/…
Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip() in client/lib/exportHTML.js read a card title and body through textContent, which decoded entity-encoded markup, and then interpolated titleText and allText into content.innerHTML in the exported index.html. A board member could store an entity-encoded event-handler payload in a card title that remained inert…
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-75916] SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autoc…
SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/hint/extend.ts), a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can set these metadata fields on a block can inject a self-firing payload (e.g. …
nvdaltovulnerabilidad CVSS 8.6 NVD