Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Multiple Vendors" — 15147 resultados ✕ Limpiar búsqueda
24,658
Total alertas
5025
Críticas
18870
Altas
8
Ransomware
2814
Esta semana
RSS
Alta × Limpiar todo ×
M Alto vulnerabilidad
08/09/2026
[CVE-2026-62648] A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The length of the URL c…
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The length of the URL component contained in pre-authenticated HTTP messages is not properly validated before appending additional data to it, resulting in an out-of-bounds write condition in memory. This could allow an unauthenticated remote attacker to crash the affected device, causing a reboot and resulting in a denia…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-34223] A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC Click…
A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC family V8 (All versions), Desigo CC family V9 (All versions), Desigo CC Flex Client V6 (All versions), Desigo CC Flex Client V7 (All versions), Desigo CC Installed Client V6 (All versions), Desigo CC Installed Client V7 (All versions). The affected applicatio…
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-81798] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-81806] Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side …
Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-84817] Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.
Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-84818] Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.
Unauthenticated Cross Site Scripting (XSS) in Open User Map
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-84820] Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons…
Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
nvdaltovulnerabilidad CVSS 7.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
08/09/2026
[CVE-2026-76561] A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificat…
A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's ExternalProcessConstraint mechanism to execute arbitrary commands with attacker-controlled environment variables, achievi…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-81781] Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting In…
Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-81790] Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez…
Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Csomagpontok és szállítási címkék WooCommerce-hez: from n/a before 4.2.8.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-71375] Improper restriction of XML external entity reference vulnerability in Cosminexus Component Containe…
Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 bef…
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-48888] Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows …
Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before 11.1.0.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-76967] SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally…
SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is next launched, the crafted content is processed and could lead to arbitrary code execution in the context of the user. This res…
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-76958] SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources i…
SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the attacker to read sensitive file contents from the server and expose them through monitoring or logging…
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-66767] SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a…
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation could result in high impact on confidentiality and integrity, with low impact on availability of the applic…
nvdaltovulnerabilidad CVSS 7.7 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86544] knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code acti…
knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86439] knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing atta…
knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files accessible to the server process.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86538] knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/prev…
knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read sensitive files like credentials and configuration through the JSON response.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86539] knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embeddin…
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport error messages that reveal network reachability information.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86540] knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project co…
knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.
nvdaltovulnerabilidad CVSS 7.8 NVD