Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,434
Total alertas
3054
Críticas
10108
Altas
8
Ransomware
1741
Esta semana
RSS
Alta × cwe-352 × Limpiar todo ×
M Alto vulnerabilidad
02/07/2026
[CVE-2026-57758] Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce <= 1.0.8.2 ve…
Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
02/07/2026
[CVE-2026-57759] Unauthenticated Cross Site Request Forgery (CSRF) in ProfileGrid <= 5.9.9.7 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in ProfileGrid
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
02/07/2026
[CVE-2026-57751] Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login <= 1.1.39 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
01/07/2026
[CVE-2026-57723] Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS al…
Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Path Traversal. This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.12.
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
01/07/2026
[CVE-2026-12158] The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-S…
The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0.9.1. This is due to missing or incorrect nonce validation on the process_request function. This makes it possible for unauthenticated attackers to escalate the privileges of an arbitrary form submitter to administrator by creating a malic…
nvdaltovulnerabilidad CVSS 8.8 NVD
A Alto vulnerabilidad
29/06/2026
[CVE-2026-43735] The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and i…
The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may exfiltrate data cross-origin.
nvdaltovulnerabilidad CVSS 8.1 NVD
B Alto vulnerabilidad
26/06/2026
[CVE-2026-50132] Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token…
Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token/handoff` is a public endpoint (no auth required) that performs a permanent, state-changing operation: it binds an external chat identity (Slack/Discord/MS Teams) to an authenticated Budibase user account, with no consent UI and no CSRF protection. The session token in the URL is created by the atta…
nvdaltovulnerabilidad CVSS 7.3 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
26/06/2026
[CVE-2026-52784] OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there…
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a CSRF on TARGET through /users/:id via POST parameter "user[admin]". This vulnerability is fixed in 17.3.3 and 17.4.1.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-57659] Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <=…
Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-57655] Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2025-68052] Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
24/06/2026
[CVE-2026-52800] Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization team member management…
Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization team member management can be performed via GET requests without CSRF protection. If a victim who is an organization owner is logged in and is tricked into visiting a crafted link, an attacker-controlled user can be added to the Owners team. As a result, the attacker gains organization owner–equivalent privileges. This v…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
18/06/2026
[CVE-2026-55744] Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Pe…
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.main.php, the file upload action ('a=upload') processes uploaded files without calling cot_check_xg() to validate the anti-CSRF token, even though sibling actions such as 'delete' (line 272) do. A remote attacker who lures an authenticated use…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
18/06/2026
[CVE-2026-55741] Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the ad…
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.config.php, the configuration update action ('a=update') processes POST data via cot_config_update_options() without calling cot_check_xg() to validate the anti-CSRF token (the 'x' parameter), unlike other admin handlers (e.g. admin.structure…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
17/06/2026
[CVE-2026-22342] Unauthenticated Cross Site Request Forgery (CSRF) in WordPress Dating Theme <= 11.2.0 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in WordPress Dating Theme
nvdaltovulnerabilidad CVSS 8.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
O Alto vulnerabilidad
17/06/2026
[CVE-2026-46955] Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Person). …
Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Person). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Human Resources. Successful attacks require human interaction from a person other than the attacker. Successful attacks of t…
nvdaltovulnerabilidad CVSS 7.5 NVD
O Alto vulnerabilidad
17/06/2026
[CVE-2026-46894] Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Pag…
Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle iSupplier Portal. Successful attacks require human interaction from a person other than the attacker. Successful attacks o…
nvdaltovulnerabilidad CVSS 8.0 NVD
O Alto vulnerabilidad
17/06/2026
[CVE-2026-46787] Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten…
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the…
nvdaltovulnerabilidad CVSS 8.0 NVD
M Alto vulnerabilidad
12/06/2026
[CVE-2026-49396] Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From…
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.0.14, cross-site GET request can trigger stored cron commands on a victim's agents. This issue has been patched in version 2.0.14.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
12/06/2026
[CVE-2026-48612] Improper state verification in the OAuth implementation could allow an attacker to manipulate the au…
Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow and cause a victim’s account to be linked to an attacker-controlled account. This can result in unauthorized account linking and potential account takeover.
nvdaltovulnerabilidad CVSS 8.0 NVD