Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 1 hora
Buscando: "X" — 12565 resultados ✕ Limpiar búsqueda
22,419
Total alertas
4761
Críticas
17027
Altas
8
Ransomware
1260
Esta semana
RSS
Alta × Limpiar todo ×
M Alto vulnerabilidad
23/09/2026
[CVE-2026-80412] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute a…
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper escaping of connector property values during OSH script generation.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-80425] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute a…
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-96556] A flaw has been found in Neethuharii CafeManagement. Affected by this vulnerability is the function …
A flaw has been found in Neethuharii CafeManagement. Affected by this vulnerability is the function addcashier of the file AddCashierCode.php. Executing a manipulation of the argument uname/pass/role/status can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not res…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-6794] IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory …
IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attacker can exploit this flaw to corrupt heap memory and execute arbitrary code in the context of the affected process.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-6935] IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully qualifying executabl…
IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully qualifying executable paths or adequately restricting search path resolution. As a result, an attacker with local system access can manipulate the search path environment to execute untrusted or malicious code.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-75886] A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfigura…
A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the op…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-80379] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute a…
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
nvdaltovulnerabilidad CVSS 8.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
23/09/2026
[CVE-2026-96889] A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincl…
A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-94183] Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page…
Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar, misleading the user about the origin of displayed content and increasing the risk of phishing.
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-85475] A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsy…
A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE — into an rsyslog RainerScript config file without neutralizing RainerScript syntax. A privileged (superuser) user can injec…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-84714] A flaw was found in the automation-controller input-validation guard sanitize_jinj…
A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior '}' or '%' character, so a Jinja expression containing an inner brace (for example an empty dict) is accep…
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-84683] A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of j…
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8 hyperlink sequence in the output is expanded into an HTML anchor whose href is not scheme- filtered or esca…
nvdaltovulnerabilidad CVSS 8.7 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-84691] A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that f…
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an administrator-controlled Python format-string template that is rendered with a live user object as an argument. Because Python string formatting permits attribute and item traversal on its arguments, an administrator can craft a template that w…
nvdaltovulnerabilidad CVSS 8.7 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-84706] A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type …
A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list (an ANSIBLE_* prefix check plus a fixed ENV_BLOCKLIST) that omits process-hijacking loader variables such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP and GIT_SSH_COMMAND. Combined with the credential file inj…
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-96541] A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can o…
A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is clos…
nvdaltovulnerabilidad CVSS 7.5 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95603] Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions.
Shop manager PHP Object Injection in Reycob Product Import Export
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95528] Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions…
Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95529] Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-95515] Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/09/2026
[CVE-2026-94176] Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP
nvdaltovulnerabilidad CVSS 7.1 NVD