Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,434
Total alertas
3054
Críticas
10108
Altas
8
Ransomware
1777
Esta semana
RSS
M Alto vulnerabilidad
03/06/2026
[CVE-2026-35082] The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files…
The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user-supplied input.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
03/06/2026
[CVE-2026-35083] A remote attacker with user privileges can exploit a stack buffer overflow to gain full system acces…
A remote attacker with user privileges can exploit a stack buffer overflow to gain full system access as root.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
03/06/2026
[CVE-2026-35076] The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local fi…
The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
03/06/2026
[CVE-2026-35077] The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local …
The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
03/06/2026
[CVE-2026-35078] The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local file…
The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.
nvdaltovulnerabilidad CVSS 8.1 NVD
A Alto vulnerabilidad
03/06/2026
[CVE-2025-14774] Incorrect Authorization vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.
Incorrect Authorization vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
03/06/2026
[CVE-2025-15655] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla School Management allows SQL Injection. This issue affects School Management: from n/a through 93.2.0.
nvdaltovulnerabilidad CVSS 7.6 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
03/06/2026
[CVE-2025-15656] Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalati…
Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalation. This issue affects School Management: from n/a through 93.2.0.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
03/06/2026
[CVE-2026-41032] It is possible for an unauthenticated adjacent attacker to download log files of the controller, whi…
It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information.
nvdaltovulnerabilidad CVSS 7.5 NVD
A Alto vulnerabilidad
03/06/2026
[CVE-2025-14772] Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus. This issue affect…
Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.
nvdaltovulnerabilidad CVSS 8.8 NVD
A Alto vulnerabilidad
03/06/2026
[CVE-2025-14773] Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i…
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.
nvdaltovulnerabilidad CVSS 8.0 NVD
L Alto vulnerabilidad
03/06/2026
[CVE-2026-4035] A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment v…
A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the `api_key` field in gateway secrets can accept `$ENV_VAR` references, which are resolved against the MLflow server's env…
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
03/06/2026
[CVE-2025-15654] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fox-themes Prague allows Reflected XSS. This issue affects Prague: from n/a through 2.2.8.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
03/06/2026
[CVE-2026-50031] ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. The Intell…
ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It is implemented by a large number of hardware manufacturers to support system management. It is most commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors comma…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
03/06/2026
[CVE-2026-10704] A vulnerability was detected in SourceCodester Pizzafy E-Commerce System 1.0. Affected by this vulne…
A vulnerability was detected in SourceCodester Pizzafy E-Commerce System 1.0. Affected by this vulnerability is the function Login of the file /admin/admin_class_novo.php of the component Administrative Control Panel. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.
nvdaltovulnerabilidad CVSS 7.3 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
03/06/2026
[CVE-2026-10694] A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this iss…
A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this issue is the function include of the file /index.php. The manipulation of the argument page results in file inclusion. The attack can be launched remotely. The exploit is now public and may be used.
nvdaltovulnerabilidad CVSS 7.3 NVD
R Alto vulnerabilidad
03/06/2026
[CVE-2026-9334] Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when d…
Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests `SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV`, which evaluates SvRV(old_value) before establishing tha…
nvdaltovulnerabilidad CVSS 7.3 NVD
R Alto vulnerabilidad
03/06/2026
[CVE-2026-9516] Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input …
Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past the mark with SvPV_set() and restores it only on the normal return path. When decoding aborts through a Perl exception, for example a filter_json_object callback t…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
03/06/2026
Vulnerabilidad crítica en Mirasvit Full Page Cache Warmer bajo explotación activa
CISA confirma explotación activa de CVE-2026-45247 en extensiones Mirasvit Full Page Cache Warmer para plataformas de e-commerce. La vulnerabilidad afecta directamente a tiendas online en México y LATAM que usan este módulo de optimización de caché. No se ha detectado uso en campañas de ransomware documentadas hasta la fecha.
mirasvitexplotación activavulnerabilidad CISA KEV
L Alto vulnerabilidad
02/06/2026
[CVE-2026-44654] LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and in…
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, a shared-agent editor can delete file records through `DELETE /api/files` that the owner has reused across multiple agents. The deletion removes the file globally — not just from the shared agent — breaking the owner's other private agents that reference the same `file_id`. The privat…
nvdaltovulnerabilidad CVSS 8.1 NVD