Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,113
Total alertas
4677
Críticas
16848
Altas
8
Ransomware
1020
Esta semana
RSS
Alta × cwe-693 × Limpiar todo ×
M Alto vulnerabilidad
30/07/2026
[CVE-2026-17899] Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attac…
Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Low)
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-17677] Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a r…
Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-67427] Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workf…
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability policy denylist for env.get and env.load_dotenv and exfiltrate secrets through allowed modules. This issue…
nvdaltovulnerabilidad CVSS 8.6 NVD
A Alto vulnerabilidad
27/07/2026
[CVE-2026-28912] A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8,…
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A user may be able to elevate privileges.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
22/07/2026
[CVE-2025-44090] An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and…
An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
22/07/2026
[CVE-2025-50324] An issue in Milos Paripovic OneCommander v.3.96.0.0 allows a remote attacker to execute arbitrary co…
An issue in Milos Paripovic OneCommander v.3.96.0.0 allows a remote attacker to execute arbitrary code via the OneCommander.exe component.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
22/07/2026
[CVE-2025-50327] An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privile…
An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execute arbitrary code via a bypass of the Mark-of-the-Web protection mechanism
nvdaltovulnerabilidad CVSS 8.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
22/07/2026
[CVE-2025-50330] An issue in ZipGenius Team ZipGenius v.6.3.2.3116 and before allows a remote attacker to escalate pr…
An issue in ZipGenius Team ZipGenius v.6.3.2.3116 and before allows a remote attacker to escalate privileges and execute arbitrary code via the zipgenius.exe.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
22/07/2026
[CVE-2025-44089] An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloadin…
An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
16/07/2026
[CVE-2026-44982] CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/re…
CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from max(r.ContentLength, 0), so HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests without a content-length header produced an empty body and caused WAF rules targeting REQUEST_BODY, BODY_ARGS, ARGS_POST, JSON,…
nvdaltovulnerabilidad CVSS 7.2 NVD
S Alto vulnerabilidad
14/07/2026
[CVE-2026-49981] Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function all…
Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later sandboxed render to reuse a template that was originally checked with a different or empty policy. This issue is fixed in version 3.27.0.
nvdaltovulnerabilidad CVSS 8.2 NVD
S Alto vulnerabilidad
14/07/2026
[CVE-2026-48808] Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox st…
Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(), so SourcePolicyInterface decisions are lost and a template author can read public or magic properties not allowed by the sandbox policy. This issue is fixed in version 3.27.0.
nvdaltovulnerabilidad CVSS 7.5 NVD
S Alto vulnerabilidad
14/07/2026
[CVE-2026-46638] Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a templ…
Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without re-invoking checkSecurity(), allowing the cached template to use tags, filters, and functions that should have been denied by SecurityPolicy::checkSecurity(). This issue is fixed in version 3.26.0.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
14/07/2026
[CVE-2026-50646] Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code local…
Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
14/07/2026
[CVE-2026-47305] Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locall…
Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally.
nvdaltovulnerabilidad CVSS 7.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
10/07/2026
[CVE-2026-61437] PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vuln…
PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFlow._resolve_pydantic_class (src/praisonai-agents/praisonaiagents/workflows/workflows.py). When a workflow step uses a string output_pydantic reference, the framework locates and imports a sibling tools.py from the workflow file's directory via importlib exec_module without sandbo…
nvdaltovulnerabilidad CVSS 7.8 NVD
P Alto vulnerabilidad
09/07/2026
[CVE-2026-0278] Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) compone…
Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) component for Windows allow a local user to bypass DLP policy enforcement controls. The Prisma Access Agent on macOS is not affected.
nvdaltovulnerabilidad CVSS 7.8 NVD
T Alto vulnerabilidad
04/07/2026
[CVE-2026-14535] In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unc…
In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless of whether the import is flagged as unsafe. This call registers the shortened code representation in the shared AnalysisContext.reported_shortened_code set. When the MLAllowlist analysis pass subsequen…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
04/07/2026
[CVE-2025-71373] picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allow…
picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle payloads using operator.methodcaller that execute arbitrary code when loaded, compromising systems relying on picklescan for validation.
nvdaltovulnerabilidad CVSS 8.1 NVD
G Alto vulnerabilidad
01/07/2026
[CVE-2026-14409] Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker…
Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)
nvdaltovulnerabilidad CVSS 7.5 NVD