Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,113
Total alertas
4677
Críticas
16848
Altas
8
Ransomware
1019
Esta semana
RSS
Alta × cwe-502 × Limpiar todo ×
M Alto vulnerabilidad
19/08/2026
[CVE-2026-49816] Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vuln…
Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-49817] Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vuln…
Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
19/08/2026
Vulnerabilidad alta de deserialización en SPLWare esProc hasta versión 20260507
Se ha identificado una vulnerabilidad de deserialización insegura en SPLWare esProc que afecta la función ObjectInputStream.readUnshared en SocketData.java. Un atacante remoto puede explotar esta falla para ejecutar código arbitrario en sistemas que ejecuten versiones vulnerables, comprometiendo servidores de procesamiento de datos en empresas de LATAM que utilizan esta plataforma de análisis paralelo.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-74012] Editor PHP Object Injection in TaxoPress <= 3.51.0 versions.
Editor PHP Object Injection in TaxoPress
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-66620] Editor PHP Object Injection in OptionTree <= 2.7.3 versions.
Editor PHP Object Injection in OptionTree
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-32465] Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.
Customer PHP Object Injection in Essential Real Estate
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
17/08/2026
[CVE-2026-16138] In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of…
In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.
nvdaltovulnerabilidad CVSS 8.0 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
16/08/2026
Vulnerabilidad alta en Podlove Podcast Publisher para WordPress permite eliminación de archivos arbitrarios
El plugin Podlove Podcast Publisher para WordPress (versiones hasta 4.5.3) contiene una vulnerabilidad alta (CVSS 8.8) que permite a atacantes autenticados con acceso de contribuidor eliminar archivos arbitrarios en el servidor. Esta falla en validación de rutas puede derivar en ejecución remota de código, comprometiendo servidores de empresas mediáticas y plataformas de podcasting en LATAM que alojen este plugin.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
14/08/2026
[CVE-2026-19826] A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian…
A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The project closed the issue report as "not planned" without any fu…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
13/08/2026
[CVE-2026-66256] ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig. …
** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an …
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
13/08/2026
[CVE-2026-28176] Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.
Unauthenticated PHP Object Injection in Booking Activities
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
13/08/2026
[CVE-2026-27380] Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.
Editor PHP Object Injection in Car Rental Manager
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
12/08/2026
[CVE-2026-73325] Fujitsu Research's OneCompression library 1.2.0 contains an unsafe deserialization vulnerability tha…
Fujitsu Research's OneCompression library 1.2.0 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.load_quantized_model_pt() unconditionally calls torch.load with weights_only=False, invoking Python's pickle machinery during deserialization. Attackers can embed malicious __reduce_…
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
12/08/2026
[CVE-2026-67260] Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task…
Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept by the scheduler. That sweep deserializes the task instance's `next_kwargs` without an allow-list, so a Dag author — who controls that value through the task execution API — can cause an arbitrary module import and object instantiation inside the scheduler process, or terminate the sche…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
11/08/2026
[CVE-2026-48397] Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result…
Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
nvdaltovulnerabilidad CVSS 8.6 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
11/08/2026
[CVE-2026-70321] Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex…
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
11/08/2026
[CVE-2026-66808] Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex…
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
11/08/2026
[CVE-2026-65815] Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attac…
Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
11/08/2026
[CVE-2026-66805] Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex…
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
11/08/2026
[CVE-2026-65663] Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex…
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
nvdaltovulnerabilidad CVSS 8.8 NVD