Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,162
Total alertas
4698
Críticas
16876
Altas
8
Ransomware
1038
Esta semana
RSS
Alta × cwe-284 × Limpiar todo ×
M Alto vulnerabilidad
27/08/2026
Vulnerabilidad alta en CodeMeter Runtime permite ejecución remota de comandos de configuración
CodeMeter Runtime versiones anteriores a 8.41a y 9.10 presentan una falla en la validación de origen de red que permite a atacantes remotos ejecutar comandos de configuración reservados para clientes locales o de la misma red. Un atacante puede leer datos sensibles del servidor y modificar valores en Server.ini, comprometiendo la integridad de sistemas que utilizan esta tecnología de licenciamiento en infraestructuras altas de empresas en LATAM.
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
26/08/2026
[CVE-2026-77538] A malicious actor with access to the network could exploit an Improper Access Control vulnerability …
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to escalate privileges within the UniFi Connect Application.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
26/08/2026
[CVE-2026-78236] An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to a…
An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed process.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
24/08/2026
[CVE-2026-61419] Dell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Access Control vulnerability. A …
Dell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
24/08/2026
[CVE-2026-78245] A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_upl…
A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
24/08/2026
[CVE-2026-78202] A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_setting…
A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
21/08/2026
[CVE-2026-55622] Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorizati…
Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they are not authorized to access.…
nvdaltovulnerabilidad CVSS 7.7 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
21/08/2026
[CVE-2026-55621] Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorizati…
Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not au…
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
21/08/2026
[CVE-2026-16576] The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 d…
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14-installation capability, allowing users such as Shop Man…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-76313] In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the…
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution (RCE) by uploading a malicious knowledge bundle and causing it to be used by distributed search, which can allow for access to all relevant data and affect system integrity and availability. The vulnerability is possible because th…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-13174] The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting …
The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-50138] goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with Web…
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP port. The WebDAV port is wired straight to `golang.org/x/net/webdav.Handler` with no equivalent guard, so an authenticated WebDAV client can `PUT`, `DELETE`, `MKCOL`…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
14/08/2026
Vulnerabilidad alta en File Browser permite acceso no autorizado a archivos de otros usuarios
File Browser versiones anteriores a 2.63.20 contiene una falla de aislamiento en los mecanismos de autenticación por proxy y auto-aprovisionamiento de usuarios. Atacantes con credenciales válidas pueden leer, modificar, eliminar y compartir archivos de otros usuarios al explotar la asignación del scope raíz del servidor. Esta vulnerabilidad afecta especialmente a organizaciones en LATAM que despliegan File Browser en entornos multi-usuario o en arquitecturas de proxy.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
13/08/2026
[CVE-2026-59501] CWE-284: Improper Access Control
CWE-284: Improper Access Control
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
13/08/2026
[CVE-2026-59505] CWE-284: Improper Access Control
CWE-284: Improper Access Control
nvdaltovulnerabilidad CVSS 8.6 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
12/08/2026
[CVE-2026-13367] IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in th…
IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in the oninit setuid-root utility.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
12/08/2026
[CVE-2026-59914] Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentic…
Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
12/08/2026
[CVE-2026-59917] Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Acc…
Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
12/08/2026
[CVE-2026-13171] The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-l…
The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
11/08/2026
[CVE-2026-66804] Improper access control in Windows Cross Device Service allows an authorized attacker to elevate pri…
Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.
nvdaltovulnerabilidad CVSS 7.8 NVD