Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,181
Total alertas
4701
Críticas
16892
Altas
8
Ransomware
1052
Esta semana
RSS
Alta × cwe-862 × Limpiar todo ×
M Alto vulnerabilidad
05/07/2026
[CVE-2026-6509] Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardu…
Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows Privilege Escalation. This issue affects Pardus Update: from
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
03/07/2026
[CVE-2026-27771] Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package s…
Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
03/07/2026
[CVE-2026-25038] Gitea 1.26.2 allows unauthorized users to access labels of private organizations.
Gitea 1.26.2 allows unauthorized users to access labels of private organizations.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
03/07/2026
[CVE-2026-14460] Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardu…
Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
02/07/2026
[CVE-2026-57746] Subscriber Broken Access Control in Booked <= 3.0.0 versions.
Subscriber Broken Access Control in Booked
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
02/07/2026
[CVE-2026-57688] Unauthenticated Broken Access Control in POS Entegratör <= 3.7.103 versions.
Unauthenticated Broken Access Control in POS Entegratör
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
02/07/2026
[CVE-2026-39448] Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 versions.
Unauthenticated Broken Access Control in NOWPayments for WooCommerce
nvdaltovulnerabilidad CVSS 7.5 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
02/07/2026
[CVE-2025-69134] Unauthenticated Arbitrary Content Deletion in OpenAI Chatbot for WordPress – Helper <= 1.1.4 version…
Unauthenticated Arbitrary Content Deletion in OpenAI Chatbot for WordPress – Helper
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
01/07/2026
[CVE-2026-1239] The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to…
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the 'ninja-forms-views/token/refresh' REST callback in all versions up to, and including, 3.14.1. This makes it possible for unauthenticated attackers to view form submissions, which could potentially contain sensitive information.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
01/07/2026
[CVE-2026-13468] The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerab…
The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access and export the contents of any visualizer chart on the site — includ…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
30/06/2026
[CVE-2026-58377] JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low…
JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low-privilege users to perform full create, read, update, and delete operations on OpenAPI credentials by accessing the OpenApiAuthController and OpenApiPermissionController endpoints which lack Shiro authorization annotations. Attackers can exploit the unenforced access controls to list, add, edit, an…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
30/06/2026
[CVE-2026-58165] OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerability that …
OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerability that allows authenticated non-admin identities with fine-grained enrollment management permissions to create enrollments for any identity, including the default administrator, because the ApplyCreate function in controller/model/enrollment_manager.go verifies only that the target identity exists without …
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
30/06/2026
[CVE-2026-58168] DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privi…
DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed_mcp_tools function returning None instead of a denied result when mcp_tools is omitted from a user's grant in deeptutor/multi_user/tool_access.py. Attackers or prompt-injected content acting within a user session can enumerate and invoke…
nvdaltovulnerabilidad CVSS 8.8 NVD
A Alto vulnerabilidad
30/06/2026
[CVE-2026-54475] Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.…
Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be broken as this is only checked in the client, allowing a different connection to consume from another connection's temporary destination. This issue affects Apache A…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
29/06/2026
[CVE-2026-57332] Subscriber Broken Access Control in Wallet System for WooCommerce <= 2.7.6 versions.
Subscriber Broken Access Control in Wallet System for WooCommerce
nvdaltovulnerabilidad CVSS 7.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
29/06/2026
[CVE-2025-2902] Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform. Th…
Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H: before DKCMAIN Ver. 93-07-26-xx/00, GUM Ver. 93-07-26/00; Hitachi Virtual Storage Platform 5100, 5500, 5100H, 5500H, 5200, 5600, 5200H, 5600H: before DKCMAIN Ver. 90-09-27-00/00, GUM Ver. 90…
nvdaltovulnerabilidad CVSS 8.3 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-55188] RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, …
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket replication admin API. The ListRemoteTargetHandler handler for listing remote replication targets only checks whether request credentials exist, but does not verify that the caller has replication or administrator permissions. As a result, an aut…
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-55189] RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, …
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, when the FTP frontend is enabled, the FTP read and probe handlers dispatch directly to the storage backend without ever calling the IAM authorization function that the FTP write/list handlers (and the entire HTTP S3 path) use. As a result, any user who can authenticate to the FTP listener — includin…
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-49991] RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users wi…
RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely breaking multi-tenant isolation. The vulnerability chains three flaws: No ../ sanitization in tar entry ke…
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-47193] OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the j…
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1.
nvdaltovulnerabilidad CVSS 7.5 NVD