Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Multiple Vendors" — 15065 resultados ✕ Limpiar búsqueda
24,477
Total alertas
5003
Críticas
18769
Altas
8
Ransomware
2706
Esta semana
RSS
Alta × Limpiar todo ×
M Alto vulnerabilidad
27/08/2026
[CVE-2026-81271] Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
27/08/2026
[CVE-2026-78261] Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
27/08/2026
[CVE-2026-78271] Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions.
Editor Privilege Escalation in FluentCRM Pro
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
27/08/2026
[CVE-2026-78276] Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.
Editor PHP Object Injection in Fluent Boards Pro
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
27/08/2026
[CVE-2026-78281] Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.
Unauthenticated Cross Site Scripting (XSS) in CP Media Player
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
27/08/2026
[CVE-2026-78283] Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.
Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
27/08/2026
[CVE-2026-78257] Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.
Contributor PHP Object Injection in Booking and Rental Manager
nvdaltovulnerabilidad CVSS 8.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
27/08/2026
[CVE-2026-27330] Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.
Unauthenticated Broken Access Control in Mobile App for WooCommerce
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
27/08/2026
[CVE-2026-32550] Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.
Subscriber SQL Injection in Kadence Shop Kit
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
27/08/2026
[CVE-2026-32564] Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
27/08/2026
[CVE-2026-78137] The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on…
The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO offer feature is enabled.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
27/08/2026
[CVE-2026-78333] The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submit…
The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
27/08/2026
[CVE-2026-77017] The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may s…
The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its configuration file and authentication secrets.
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
27/08/2026
[CVE-2026-77018] The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may s…
The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor validate the type of the file it subsequently writes into a publicly reachable directory, allowing users with a role as low as subscriber to upload arbitrary files and achieve remote code execution.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
27/08/2026
[CVE-2026-47886] Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulner…
Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3…
nvdaltovulnerabilidad CVSS 7.5 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
27/08/2026
[CVE-2026-47888] A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framewo…
A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.0.RELEASE - 5.2.25.RELEASE
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
27/08/2026
[CVE-2026-47889] A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies with…
A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
27/08/2026
[CVE-2026-47885] The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMe…
The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
27/08/2026
[CVE-2026-47877] Spring Security Authorization Server's default consent page renders user-controlled values without H…
Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
27/08/2026
[CVE-2026-47879] Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for d…
Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.13 and earlier
nvdaltovulnerabilidad CVSS 7.7 NVD