Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,689
Total alertas
4802
Críticas
17240
Altas
8
Ransomware
1388
Esta semana
RSS
M Alto vulnerabilidad
03/07/2026
[CVE-2026-14605] A vulnerability was identified in RT-Thread up to 5.0.2. Affected by this vulnerability is the funct…
A vulnerability was identified in RT-Thread up to 5.0.2. Affected by this vulnerability is the function recvmsg in the library bsp/loongson/ls1cdev/libraries/ls1c_can.h of the component ls1c CAN Handler. Such manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about …
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
03/07/2026
[CVE-2026-14606] A security flaw has been discovered in RT-Thread up to 5.0.2. Affected by this issue is the function…
A security flaw has been discovered in RT-Thread up to 5.0.2. Affected by this issue is the function CAN_Receive in the library bsp/synwit/libraries/SWM341_CSL/CMSIS/DeviceSupport/SWM341.h of the component SWM341 CAN Handler. Performing a manipulation results in stack-based buffer overflow. The attack needs to be approached locally. The exploit has been released to the public and may be used for a…
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
03/07/2026
[CVE-2026-58379] A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulner…
A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service (DoS) by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the software incorrectly calculates buffer sizes when processing low bit-depth images, leading to an ov…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
03/07/2026
[CVE-2026-14459] Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in …
Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
03/07/2026
[CVE-2026-14460] Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardu…
Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from
nvdaltovulnerabilidad CVSS 8.8 NVD
D Alto vulnerabilidad
03/07/2026
[CVE-2026-49814] Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through…
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploi…
nvdaltovulnerabilidad CVSS 7.2 NVD
D Alto vulnerabilidad
03/07/2026
[CVE-2026-49815] Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through…
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special Elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with remote access could potentially exploi…
nvdaltovulnerabilidad CVSS 7.2 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
D Alto vulnerabilidad
03/07/2026
[CVE-2026-53478] Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through…
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with remote access could potentially exploi…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
03/07/2026
[CVE-2026-10055] In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker…
In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the HTTP request server-side, and returns the full response body to the caller. Because the destination URL is neither validated nor allowlisted, a remote attacker with access to the Theia service co…
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
03/07/2026
[CVE-2026-13341] A vulnerability exists in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.…
A vulnerability exists in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.0, which could allow a remote attacker to perform an indirect prompt injection attack and execute unintended API requests.
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
03/07/2026
[CVE-2026-10054] In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged term…
In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) without service-level authentication. WebSocket origin validation in @theia/core is fail-open: connections are accepted when the Origin header is missing or when no THEIA_HOSTS allowlist is configured (the default). The …
nvdaltovulnerabilidad CVSS 8.8 NVD
A Alto vulnerabilidad
03/07/2026
[CVE-2026-47896] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac…
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library). This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 through 4.8.0-beta00017. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
03/07/2026
[CVE-2026-9148] The Comments – wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gu…
The Comments – wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the guest commenter 'Website' field in versions up to, and including, 7.6.56 This is due to insufficient output escaping in the getCommentAuthor() function, which interpolates the stored comment_author_url value directly into single-quoted HTML attributes without applying esc_url() or esc_attr(). This mak…
nvdaltovulnerabilidad CVSS 7.2 NVD
A Alto vulnerabilidad
03/07/2026
[CVE-2026-47897] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac…
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library). This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 before 4.8.0-beta00018. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.
nvdaltovulnerabilidad CVSS 7.5 NVD
H Alto vulnerabilidad
03/07/2026
[CVE-2026-8932] libcurl would reuse a previously created connection even when some mTLS config related option had be…
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them m…
nvdaltovulnerabilidad CVSS 7.5 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
H Alto vulnerabilidad
03/07/2026
[CVE-2026-9080] Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use…
Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.
nvdaltovulnerabilidad CVSS 7.3 NVD
H Alto vulnerabilidad
03/07/2026
[CVE-2026-9545] In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it m…
In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLY…
nvdaltovulnerabilidad CVSS 7.5 NVD
H Alto vulnerabilidad
03/07/2026
[CVE-2026-9546] A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared…
A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended serve…
nvdaltovulnerabilidad CVSS 7.5 NVD
H Alto vulnerabilidad
03/07/2026
[CVE-2026-9547] When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURL…
When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fa…
nvdaltovulnerabilidad CVSS 7.4 NVD
H Alto vulnerabilidad
03/07/2026
[CVE-2026-12064] When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a dis…
When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors …
nvdaltovulnerabilidad CVSS 7.5 NVD