Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Multiple Vendors" — 13315 resultados ✕ Limpiar búsqueda
22,395
Total alertas
4758
Críticas
17006
Altas
8
Ransomware
1254
Esta semana
RSS
Alta × Limpiar todo ×
M Alto vulnerabilidad
26/06/2026
[CVE-2026-36478] An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of se…
An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of service via the DnsServerApp.exe, DnsServerApp.dll, TechnitiumLibrary.Net/Dns/DnsClient.cs components
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-38639] An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to…
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of Service (DoS) via parsing a crafted input.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-38641] An issue in the DSO::mmap_and_copy function of relibc commit 61f42d allows attackers to cause a Deni…
An issue in the DSO::mmap_and_copy function of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via loading a crafted shared library.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-55188] RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, …
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket replication admin API. The ListRemoteTargetHandler handler for listing remote replication targets only checks whether request credentials exist, but does not verify that the caller has replication or administrator permissions. As a result, an aut…
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-55189] RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, …
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, when the FTP frontend is enabled, the FTP read and probe handlers dispatch directly to the storage backend without ever calling the IAM authorization function that the FTP write/list handlers (and the entire HTTP S3 path) use. As a result, any user who can authenticate to the FTP listener — includin…
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-52783] OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenP…
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth access_token plaintext to Rails.cache under the deterministic key storage..httpx_access_token, repopulated continuously by an hourly cron and every userless-OAuth call site (see Write cadence). None of the three allowed cache…
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-52784] OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there…
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a CSRF on TARGET through /users/:id via POST parameter "user[admin]". This vulnerability is fixed in 17.3.3 and 17.4.1.
nvdaltovulnerabilidad CVSS 8.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
26/06/2026
[CVE-2026-49991] RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users wi…
RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely breaking multi-tenant isolation. The vulnerability chains three flaws: No ../ sanitization in tar entry ke…
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-47193] OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the j…
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-32833] Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerabili…
Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands by injecting shell metacharacters into the cbid.system.ntp.current POST parameter in the system time configuration interface. Attackers can submit malicious payloads through the NTP settings endpoint to achieve remote code executio…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-55441] mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feat…
mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feature gates config files (mise.toml, .tool-versions) through trust_check, but task-include files are loaded on a path that never reaches it. When a directory has a task-include dir (mise-tasks/, .mise/tasks/, …) but no config file, mise falls back to the default includes and renders each task's tera f…
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-54341] Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.0, a craf…
Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.0, a crafted RESTORE payload triggers an out-of-bounds read in DragonflyDB's listpack collection loaders, crashing the entire server process (SIGSEGV). Because DragonflyDB requires no authentication by default and RESTORE is a normal keyspace command, an unauthenticated remote attacker can crash the server w…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-55677] Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagre…
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vuln…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-56663] AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificia…
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.52, an authenticated user can bypass the SSRF / private-IP protections in SendWebRequestBlock and reach internal network services. _is_ip_blocked() in backend/backend/util/request.py does not normalize IPv4-mapped IPv6 addresses before checking resolved IPs agains…
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-57518] Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users wit…
Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the 'user: manage users' permission to escalate privileges by assigning arbitrary custom roles to themselves due to missing authorization checks in UserApiController::saveAction(). Attackers can assign themselves a custom role with the 'system: manage packages' permission and then upload and insta…
nvdaltovulnerabilidad CVSS 8.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
26/06/2026
[CVE-2026-0828] Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versions 10.5.75.0 and 11…
Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versions 10.5.75.0 and 11.11.4.0, allows unprivileged user to abuse IOCTL path and terminate protected system processes.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-57662] Contributor SQL Injection in Contest Gallery <= 30.0.0 versions.
Contributor SQL Injection in Contest Gallery
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-57663] Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions.
Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-57667] Sales Representative SQL Injection in Groundhogg <= 4.5 versions.
Sales Representative SQL Injection in Groundhogg
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-57659] Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <=…
Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin
nvdaltovulnerabilidad CVSS 8.8 NVD