Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "X" — 13308 resultados ✕ Limpiar búsqueda
24,205
Total alertas
4951
Críticas
18555
Altas
8
Ransomware
2521
Esta semana
RSS
Alta × Limpiar todo ×
M Alto vulnerabilidad
29/07/2026
[CVE-2026-15144] @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned …
@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address has multiple valid textual representations, an IPv6 capable client can defeat the rate-limit boundary by rotating addresses or by rewriting the same address in d…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-67192] Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability tha…
Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets when a GCM cipher is negotiated. Attackers can craft packets with an unvalidated length field passed directly to the GCM decrypt function, overwriting the stack cookie and return address to potentially achiev…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-16463] A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflo…
A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-65947] Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2
Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-54660] swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior t…
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $ref URLs, allowing an attacker-controlled OpenAPI spec to exfiltrate the developer or CI bearer token to…
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-54661] swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior…
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. This …
nvdaltovulnerabilidad CVSS 8.3 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-54662] swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior t…
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject T…
nvdaltovulnerabilidad CVSS 8.3 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
29/07/2026
[CVE-2026-54664] swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior…
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas.*.enum[i] values to Ts.StringValue in src/configuration.ts without escaping before templates/base/enum-data-contract.ejs renders TypeScript enum declarations, allowing an attacker-controlled OpenAPI spec to inject c…
nvdaltovulnerabilidad CVSS 8.3 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-54666] swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior…
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping JavaScript template literal interpolation, allowing an attacker-controlled path containing ${...} to execu…
nvdaltovulnerabilidad CVSS 8.3 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-67215] cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an unt…
cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and copy operations grafts duplicated subtrees to amplify document depth beyond the parser's nesting limit: cJSON_Delete() recurses with no depth bound, and the cJSON…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-65943] Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0
Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-65944] Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0
Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-14270] The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for Wo…
The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco_save_settings() function, which allows low-privileged authenticated users to modify the tc_eco_custom_file_types upload allowlist setting, …
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-18220] An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend (bfd/elf32-dlx.c…
An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend (bfd/elf32-dlx.c) in GNU binutils. The dlx_rtype_to_howto() function maps ELF relocation types to internal howto structures but fails to perform adequate bounds checking on attacker-controlled relocation type values (via ELF32_R_TYPE(r_info)) before indexing into the dlx_elf_howto_table[] array. The DLX relocation …
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-16597] The GTM4WP – A Google Tag Manager (GTM) plugin for WordPress plugin for WordPress is vulnerable to S…
The GTM4WP – A Google Tag Manager (GTM) plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Billing Fields in all versions up to, and including, 1.22.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses …
nvdaltovulnerabilidad CVSS 7.2 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
29/07/2026
[CVE-2026-58188] Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This…
Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-58189] Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SS…
Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
nvdaltovulnerabilidad CVSS 7.5 NVD
A Alto vulnerabilidad
29/07/2026
[CVE-2026-58181] The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker…
The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
nvdaltovulnerabilidad CVSS 7.5 NVD
A Alto vulnerabilidad
29/07/2026
[CVE-2026-58182] The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instan…
The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
nvdaltovulnerabilidad CVSS 8.6 NVD
A Alto vulnerabilidad
29/07/2026
[CVE-2026-58184] The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations…
The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
nvdaltovulnerabilidad CVSS 8.2 NVD