Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 42 min
22,093
Total alertas
4671
Críticas
16834
Altas
8
Ransomware
1009
Esta semana
RSS
Alta × cwe-78 × Limpiar todo ×
M Alto vulnerabilidad
14/09/2026
[CVE-2026-59960] Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.…
Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUB_HEAD_REF or ARGOS_BRANCH can flow through config.branch and getMergeBaseCommitSha() when hasRemoteContentAccess is false. The gitFetch() and gitMergeBase() functions in packages/core/src/ci-environment/git.ts interpolate these values into …
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
14/09/2026
Vulnerabilidad alta en Parallels Desktop: escalada de privilegios local vía socket mundial
Parallels Desktop ejecuta el servicio prl_disp_service con permisos root a través de un socket accesible mundialmente (/var/run/prl_disp_service.socket), permitiendo a usuarios locales ejecutar comandos arbitrarios sin validación de firma ni pertenencia a grupos administrativos. La vulnerabilidad afecta principalmente a empresas en México y LATAM que usan Parallels Desktop en infraestructuras de desarrollo, testing y virtualización en macOS, exponiendo sistemas con múltiples usuarios o acceso compartido.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
14/09/2026
[CVE-2026-90690] A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04.…
A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of the file hexstrike_server.py of the component API Tools Endpoint. Executing a manipulation of the argument additional_args/target/username/password/scan_type/payload can lead to os command injection. The attack can be launched remotely. The e…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
14/09/2026
[CVE-2026-82791] Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exi…
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
14/09/2026
[CVE-2026-82794] SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings. If this vu…
SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
14/09/2026
[CVE-2026-82777] Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exi…
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS PAC Series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
14/09/2026
[CVE-2026-82779] Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exi…
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS TM Series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
nvdaltovulnerabilidad CVSS 8.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
14/09/2026
[CVE-2026-82774] Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exi…
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
14/09/2026
[CVE-2026-82762] Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exi…
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
14/09/2026
[CVE-2026-82766] Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exi…
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SGA1000. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
14/09/2026
[CVE-2026-90617] A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a…
A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerability affects the function run_task of the file interface/main.py of the component MCP HTTP Server. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling r…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
14/09/2026
[CVE-2026-90618] A flaw has been found in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This…
A flaw has been found in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This issue affects the function LocalRuntime.execute_command of the file runtime/runtime.py of the component LocalRuntime. Executing a manipulation can lead to os command injection. The attack may be performed from remote. The exploit has been published and may be used. The pull request to fix this issu…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
14/09/2026
[CVE-2026-90619] A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04.…
A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. Impacted is an unknown function of the file hexstrike_server.py of the component Execute Endpoint. The manipulation of the argument code/script leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product i…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
13/09/2026
Vulnerabilidad alta de ejecución remota de código en Spug hasta versión 3.4.0
Spug versiones 3.4.0 y anteriores contiene una vulnerabilidad de ejecución remota de código (RCE) en la función ping_check que interpola direcciones de monitoreo suministradas por el usuario directamente en comandos de shell sin validación. Usuarios autenticados con permisos de monitor pueden inyectar metacaracteres de shell a través del endpoint /monitor/run_test/ para ejecutar comandos arbitrarios con los privilegios del proceso Spug. Esta vulnerabilidad afecta especialmente a empresas en LATAM que utilizan Spug para monitoreo de infraestructura alta.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
11/09/2026
[CVE-2026-89066] Improper neutralization of special elements used in an OS command in the task synthesis component in…
Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project configuration values and repository file names that are interpolated into generated task definitions. To rem…
nvdaltovulnerabilidad CVSS 7.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
11/09/2026
[CVE-2026-7863] Improper neutralization of special elements used in an OS command ('OS command injection') vulnerabi…
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software allows OS Command Injection. This issue affects Pardus Software: before 1.0.5.
nvdaltovulnerabilidad CVSS 8.4 NVD
M Alto vulnerabilidad
11/09/2026
[CVE-2026-8301] Improper neutralization of special elements used in an OS command ('OS command injection') vulnerabi…
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: before 1.0.8.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
10/09/2026
[CVE-2026-82095] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute a…
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
10/09/2026
[CVE-2026-82098] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute a…
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
10/09/2026
[CVE-2026-82099] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute a…
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
nvdaltovulnerabilidad CVSS 8.8 NVD