Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
25,058
Total alertas
5088
Críticas
19142
Altas
8
Ransomware
2640
Esta semana
RSS
Alta × Limpiar todo ×
M Alto vulnerabilidad
28/08/2026
[CVE-2026-55066] Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/project…
Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks accepts a body supplied task_id but TaskBucket.CanUpdate in pkg/models/kanban_task_bucket.go authorizes only the project, view, and bucket from the URL. updateTaskBucket then calls Task.ReadOne without a separate task permission check, returns the vict…
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-54788] dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, da…
dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, …
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-82227] Contributor SQL Injection in WPBulky <= 1.2.2 versions.
Contributor SQL Injection in WPBulky
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-81757] Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276 versions.
Author Remote Code Execution (RCE) in Rank Math SEO
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-81760] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Reflected XSS. This issue affects JetEngine: from n/a through 3.8.14.2.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-81767] Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.
Unauthenticated Broken Access Control in Simple Payment
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-81285] Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versio…
Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization
nvdaltovulnerabilidad CVSS 7.5 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
28/08/2026
[CVE-2026-81019] wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is…
wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known reco…
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-81020] wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is s…
wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record…
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-6176] The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripti…
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The plugin accepts review submissions from unauthenticated users through the 'cr_local_forms_submit' AJAX act…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-5934] The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, a…
The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocket_beacon AJAX endpoint. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected p…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-56854] The source-address critical option in the Permissions returned by an authentication callback was onl…
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-50979] A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.…
A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-38638] An issue in the with_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to caus…
An issue in the with_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-37237] vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exha…
vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read() without enforcing a maximum response size, allowing an attacker to exhaust server memory by providing a URL to an arbitrarily large file.
nvdaltovulnerabilidad CVSS 7.5 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
28/08/2026
[CVE-2026-37736] An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers t…
An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a crafted input.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-38636] An issue in the seekdir() function (/dirent/mod.rs) of relibc commit 61f42d allows attackers to caus…
An issue in the seekdir() function (/dirent/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/08/2026
Vulnerabilidad de agotamiento de memoria en SvelteKit 2.49.0-2.52.1 con funciones remotas
SvelteKit (@sveltejs/kit) versiones 2.49.0 a 2.52.1 con funciones remotas experimentales (experimental.remoteFunctions) contienen una vulnerabilidad de agotamiento de memoria que permite a atacantes causar negación de servicio mediante datos de formulario malformados. La asignación excesiva de memoria resultante provoca caída del proceso del servidor, afectando aplicaciones web en producción. Empresas en LATAM que usan estas versiones con esta característica experimental habilitada están en riesgo alta.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/08/2026
Vulnerabilidad de agotamiento de CPU en SvelteKit 2.49.0-2.52.1 permite denegación de servicio
SvelteKit versiones 2.49.0 a 2.52.1 con funciones remotas experimentales habilitadas contienen una vulnerabilidad que permite a atacantes enviar datos de formulario malformados para agotar recursos de CPU del servidor, causando indisponibilidad del servicio. Afecta aplicaciones web en producción en LATAM que usan estas versiones. La vulnerabilidad fue corregida en versión 2.52.2.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/08/2026
Vulnerabilidad de Path Traversal en gitoxide (gix ≤ 0.72.0 y gix-validate ≤ 0.10.0)
gitoxide, conjunto de herramientas Rust para gestión de repositorios Git, contiene una vulnerabilidad de path traversal (CVSS 7.5) en la validación de nombres de submódulos. La función de validación solo verifica la primera ocurrencia de '..', permitiendo nombres manipulados como 'a..b/../../../.git/' eludir el control. Esta validación tampoco se ejecuta en rutas de código de producción, exponiendo sistemas que procesan repositorios Git no confiables a acceso no autorizado de archivos.
nvdaltovulnerabilidad CVSS 7.5 NVD