Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,181
Total alertas
4701
Críticas
16892
Altas
8
Ransomware
1052
Esta semana
RSS
Alta × cwe-862 × Limpiar todo ×
M Alto vulnerabilidad
26/06/2026
[CVE-2026-57518] Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users wit…
Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the 'user: manage users' permission to escalate privileges by assigning arbitrary custom roles to themselves due to missing authorization checks in UserApiController::saveAction(). Attackers can assign themselves a custom role with the 'system: manage packages' permission and then upload and insta…
nvdaltovulnerabilidad CVSS 8.8 NVD
C Alto vulnerabilidad
26/06/2026
[CVE-2026-12411] Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrust…
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.
nvdaltovulnerabilidad CVSS 8.4 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-57645] newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions.
newsletters_subscribers Broken Access Control in Newsletters
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-56773] Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenti…
Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenticated user to bypass authorization checks. Attackers can read table schemas, create tables, and modify or delete records across bases and tables via endpoints like GET /api/v2/tables/get and POST /api/v2/tables/updateRecords.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-56061] Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions.
Unauthenticated Broken Access Control in Subscriptions for WooCommerce
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-56063] Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.
Unauthenticated Broken Access Control in MailChimp Block
nvdaltovulnerabilidad CVSS 8.3 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-56038] Contributor Privilege Escalation in Frisbii Pay <= 1.8.2 versions.
Contributor Privilege Escalation in Frisbii Pay
nvdaltovulnerabilidad CVSS 8.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
26/06/2026
[CVE-2026-56025] Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.
Unauthenticated Broken Access Control in Paymob for WooCommerce
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-54835] Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.
Unauthenticated Broken Access Control in Five Star Restaurant Menu
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-54837] Unauthenticated Broken Access Control in Intranet &amp; Private Site &#8211; All-In-One Intranet <= …
Unauthenticated Broken Access Control in Intranet &amp; Private Site &#8211; All-In-One Intranet
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-54840] Unauthenticated Broken Access Control in Newsletters <= 4.13 versions.
Unauthenticated Broken Access Control in Newsletters
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-54846] Unauthenticated Broken Access Control in Syncee Premium Dropshipping &amp; Wholesale <= 1.0.27 versi…
Unauthenticated Broken Access Control in Syncee Premium Dropshipping &amp; Wholesale
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-54847] Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions.
Unauthenticated Broken Access Control in Stylish Cost Calculator
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-54832] Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions.
Unauthenticated Broken Access Control in Gutenverse Companion
nvdaltovulnerabilidad CVSS 7.5 NVD
B Alto vulnerabilidad
25/06/2026
[CVE-2026-57520] Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authentic…
Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in the bulk user-remove endpoint. Attackers can supply Admin organization-user IDs in a bulk DELETE request to bypass the guard enforced on the single-user removal…
nvdaltovulnerabilidad CVSS 7.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
25/06/2026
[CVE-2026-56767] Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storag…
Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storage and webhook API handlers that allows authenticated users to access other users' robots and OAuth tokens. Attackers can read plaintext Google and Airtable access tokens, modify, delete, or execute other users' robots by bypassing ownership checks in API endpoints.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
25/06/2026
[CVE-2026-56768] Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-tas…
Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory trees.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
25/06/2026
[CVE-2026-54842] Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configu…
Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
25/06/2026
[CVE-2026-54844] Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions.
Unauthenticated Broken Access Control in CheckView Automated Testing
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
25/06/2026
[CVE-2026-54830] Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.
Unauthenticated Broken Access Control in Five Star Restaurant Reservations
nvdaltovulnerabilidad CVSS 7.5 NVD