Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
25,058
Total alertas
5088
Críticas
19142
Altas
8
Ransomware
2639
Esta semana
RSS
Alta × Limpiar todo ×
M Alto vulnerabilidad
31/08/2026
[CVE-2026-82225] Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.
Unauthenticated Broken Authentication in RegistrationMagic
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-82228] Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.
Unauthenticated Bypass Vulnerability in SiteGround Security
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-82229] Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.
Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81889] elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1…
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validate_address() validates $info['ip'], but get_remote_contents() selects fsock_get_contents(), which connects to $arr['host'] and performs a second DNS resol…
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81891] elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1…
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, .phar, .php5, and .php3 extensions are absent from mime.types, the staticMimeMap entries that map them to text/x-php are not appli…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81892] EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 an…
EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security …
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81764] Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.
Unauthenticated Cross Site Scripting (XSS) in Email Essentials
nvdaltovulnerabilidad CVSS 7.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81765] Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.
Unauthenticated Cross Site Scripting (XSS) in Tailored Tools
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81768] Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.
Unauthenticated Cross Site Scripting (XSS) in Super Store Finder
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81291] Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.
Unauthenticated Cross Site Scripting (XSS) in Uncode
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81296] Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81297] Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81298] Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.
Unauthenticated Cross Site Scripting (XSS) in LeadConnector
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81287] Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.
Subscriber SQL Injection in Charitable
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-81290] Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.
Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters
nvdaltovulnerabilidad CVSS 7.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
31/08/2026
[CVE-2026-61641] Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before …
Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverifi…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-54598] Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpo…
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database schema migrations when called over HTTP with zero authentication. Any unauthenticated attacker can trigger pending migration files against the live SQLite database. This issue has been patched in version 4.9.4.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-13732] A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/sta…
A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the f…
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-83497] Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch …
Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-72001] Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated a…
Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token verification call. Attackers holding a single valid share link for any resource can authenticate against ar…
nvdaltovulnerabilidad CVSS 8.1 NVD