Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,509
Total alertas
3066
Críticas
10171
Altas
8
Ransomware
1785
Esta semana
RSS
Alta × cwe-284 × Limpiar todo ×
M Alto vulnerabilidad
30/07/2026
[CVE-2026-16527] An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP…
An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-65943] Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0
Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-62427] [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabiliti…
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing …
nvdaltovulnerabilidad CVSS 8.8 NVD
A Alto vulnerabilidad
27/07/2026
[CVE-2026-64737] An authorization issue was addressed with improved state management. This issue is fixed in macOS Se…
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to break out of its sandbox.
nvdaltovulnerabilidad CVSS 8.2 NVD
A Alto vulnerabilidad
27/07/2026
[CVE-2026-43760] An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sonoma…
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to access user-sensitive data.
nvdaltovulnerabilidad CVSS 8.6 NVD
A Alto vulnerabilidad
27/07/2026
[CVE-2026-28945] A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS…
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to bypass network restrictions.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-14235] The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to th…
The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.
nvdaltovulnerabilidad CVSS 7.5 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
24/07/2026
[CVE-2026-9765] Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. …
Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions. Broken access control can allow attac…
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
24/07/2026
[CVE-2026-14603] The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorizatio…
The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing unauthenticated users to disable all of the site's opt-in forms and insert new template-based opt-in rows into the database.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
24/07/2026
[CVE-2026-35425] Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code…
Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network.
nvdaltovulnerabilidad CVSS 8.0 NVD
M Alto vulnerabilidad
23/07/2026
[CVE-2026-65757] Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules An…
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
23/07/2026
[CVE-2026-64876] Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP ext…
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
23/07/2026
[CVE-2024-58330] A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthentic…
A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analytics event data.
nvdaltovulnerabilidad CVSS 7.5 NVD
O Alto vulnerabilidad
22/07/2026
[CVE-2026-60371] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Platform Security for Java executes to …
nvdaltovulnerabilidad CVSS 8.0 NVD
M Alto vulnerabilidad
22/07/2026
[CVE-2026-63684] Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various ad…
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension - Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks. Unauthorized backend users or CSRF attacks could expose, create or modify extension configuration and i…
nvdaltovulnerabilidad CVSS 8.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
22/07/2026
[CVE-2026-63685] Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator r…
Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An unauthorized backend user or CSRF attack could perform database replacements, potentially causing major data corruption or site compromise.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
22/07/2026
[CVE-2026-64791] Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular La…
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissions. An unauthorized backend user or CSRF attack could install, update or remove extensions.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
22/07/2026
[CVE-2026-63265] Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Re…
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations out…
nvdaltovulnerabilidad CVSS 8.0 NVD
M Alto vulnerabilidad
22/07/2026
[CVE-2026-63280] Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular La…
Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager - Conditions administration did not consistently enforce tokens and component/mapped-item permissions.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
22/07/2026
[CVE-2026-63047] Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Bo…
Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information.
nvdaltovulnerabilidad CVSS 7.5 NVD