Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Ni" — 5723 resultados ✕ Limpiar búsqueda
22,429
Total alertas
4763
Críticas
17035
Altas
8
Ransomware
1244
Esta semana
RSS
Alta × Limpiar todo ×
M Alto vulnerabilidad
09/09/2026
[CVE-2026-86770] Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowi…
Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4_unicode_ci database collation to bypass username matching and achieve account takeover through federated login paths including SAML,…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-86771] Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF gene…
Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML() function. Attackers can craft a malicious employee_num value containing an img tag with an arbitrary HTTP(S) URL to trigger server-side requests to internal services, cloud metadata endpoints, or externa…
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-86762] Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware gro…
Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its existing API token continues to authenticate and to grant read and write access to the REST API (assets, …
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-86759] Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any a…
Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising inventory integrity and accountability.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-86750] Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before …
Snipe-IT versions
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-86751] Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing auth…
Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded by CommonMark parser, and resolved by laravel-mail-auto-embed via file_get_contents or curl, exfiltrati…
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-86754] Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allo…
Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes for bearer tokens inheriting full admin API permissions lasting up to 40 years.
nvdaltovulnerabilidad CVSS 7.3 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
09/09/2026
[CVE-2026-86741] Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in …
Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed library resolves server-side and returns as email attachments, exfiltrating sensitive files like .env credent…
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-86201] PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing whe…
PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object structures to trigger out-of-memory conditions and crash the server.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-86099] Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowin…
Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-86199] PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline …
PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2026-56711] VLC media player computes the size of a picture buffer with 32-bit arithmetic and allocates from the…
VLC media player computes the size of a picture buffer with 32-bit arithmetic and allocates from the wrapped result. In AllocatePicture in src/misc/picture.c the running total is accumulated as i_bytes += p->i_pitch * p->i_lines, and both plane_t fields are declared int in include/vlc_picture.h, so the multiplication is evaluated at 32 bits and wraps before it is widened to the size_t accumulator.…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2024-58381] PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processin…
PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties, causing the application to crash.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2024-58382] league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdo…
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
09/09/2026
[CVE-2023-54390] PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPac…
PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arrays. Attackers can send malformed JSON with unexpected null elements in LoginPacket to crash the server.
nvdaltovulnerabilidad CVSS 7.5 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
09/09/2026
[CVE-2023-54393] PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON p…
PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
09/09/2026
Vulnerabilidad de denegación de servicio en GitPython anterior a 3.1.60
GitPython versions anteriores a 3.1.60 contienen una vulnerabilidad de expresión regular en Actor.name_email_regex que procesa campos de autor en commits. Un atacante puede inyectar commits con campos de autor malformados (corchetes angulares sin cerrar) para provocar retroceso cuadrático en el parsing, agotando recursos CPU durante más de 2 minutos por acceso a commit. Esto afecta principalmente a plataformas de CI/CD y servidores de repositorios en LATAM que procesan commits de fuentes externas.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
09/09/2026
Vulnerabilidad SSRF alta en Lara Dashboard 1.3.1 permite lectura de credenciales IAM
Lara Dashboard versiones hasta 1.3.1 contiene una vulnerabilidad de falsificación de solicitudes del lado del servidor (SSRF) en el endpoint POST /api/admin/builder/markdown/fetch. Usuarios autenticados pueden obtener URLs arbitrarias y acceder a servicios HTTP internos, metadatos en la nube e incluso credenciales IAM sin validación de host ni restricciones de redirección. En entornos de AWS, Azure o Google Cloud utilizados por empresas LATAM, esta vulnerabilidad expone acceso directo a tokens de identidad y secretos almacenados en servicios internos.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
09/09/2026
Vulnerabilidad XSS almacenado en SiYuan anterior a v3.8.2 afecta búsqueda de activos
SiYuan versiones anteriores a v3.8.2 contienen una vulnerabilidad de cross-site scripting (XSS) almacenado en la función de búsqueda de activos. Atacantes autenticados pueden inyectar código malicioso en nombres de archivos que se ejecuta en el navegador de usuarios legítimos, permitiendo manipulación de estado de aplicación y ejecución de solicitudes API no autorizadas. El riesgo es moderado-alto en entornos colaborativos donde múltiples usuarios acceden a repositorios compartidos.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
09/09/2026
Vulnerabilidad XSS almacenado alta en SiYuan anterior a v3.8.2 afecta vista previa de activos
SiYuan antes de la versión 3.8.2 contiene una vulnerabilidad de cross-site scripting (XSS) almacenado en la función de vista previa de activos de búsqueda. Los atacantes pueden insertar contenido malicioso en activos de texto dentro de espacios de trabajo para ejecutar código JavaScript con privilegios autenticados. Esto permite acceso no autorizado a APIs internas y manipulación de datos en la instancia SiYuan, representando riesgo significativo para organizaciones que almacenan información sensible en esta plataforma de gestión de conocimiento.
nvdaltovulnerabilidad CVSS 7.3 NVD