Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Multiple Vendors" — 15104 resultados ✕ Limpiar búsqueda
24,580
Total alertas
5011
Críticas
18822
Altas
8
Ransomware
2781
Esta semana
RSS
Alta × Limpiar todo ×
M Alto vulnerabilidad
04/09/2026
[CVE-2026-9317] Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that a…
Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-85656] An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.…
An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands with root privileges via a Java process whose executable path contains embedded newline characters.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-85654] Improper neutralization of special elements used in a template engine in the CDK generator in Amazon…
Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated application via crafted table, index, or attribute names in a data model file.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-82538] ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository…
ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository trash table where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation against declared sortable columns. Authenticated users with write permission on any container can inject arbitrary SQL through the sort parameter, and b…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-61686] SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the `DataGrid` LiveCompon…
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the `DataGrid` LiveComponent deserializes a `context` prop value using PHP's `unserialize()` after receiving it from the client. Because the prop is marked `writable: true`, an authenticated attacker can supply an arbitrary PHP serialized payload. Version 3.0.1 fixes the issue.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-19534] undici's WebSocket client crashes the whole Node.js process during the opening handshake when a serv…
undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeErr…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2021-44320] Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (D…
Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (DoS) attacks. An attacker can harm the device availability (i.e., video streaming and control) by using tool to perform an IPv4 flood attack. Verified attacks includes SYN flooding and UDP flooding.
nvdaltovulnerabilidad CVSS 7.5 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
04/09/2026
[CVE-2026-84961] undici's BalancedPool constructor passes its entire options object through an internal deep-clone th…
undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer who…
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-85152] undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the ca…
undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant …
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-18175] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due t…
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due to improper authorization in the DDM target dispatcher.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-18221] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improp…
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-18486] IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote authenticated attacker…
IBM ContextForge MCP Gateway
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-18489] IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge could allow a remote att…
IBM ContextForge MCP Gateway - Translate utility
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-77822] IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive informa…
IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-19303] IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrar…
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory.
nvdaltovulnerabilidad CVSS 8.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
04/09/2026
[CVE-2026-19304] IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitiv…
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-19305] IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information …
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery.
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-19306] IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from …
IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material (secret_key, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories) — by supplying absolute paths or traversal sequences in the files parameter of an authenticated build request. The file content…
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-19300] IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information …
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-18905] IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) <= v1.0.6 MCP Context Forge could allow a …
IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`)
nvdaltovulnerabilidad CVSS 7.7 NVD