Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "X" — 12579 resultados ✕ Limpiar búsqueda
22,448
Total alertas
4765
Críticas
17048
Altas
8
Ransomware
1257
Esta semana
RSS
Alta × Limpiar todo ×
M Alto vulnerabilidad
20/09/2026
[CVE-2026-92541] The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote…
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
20/09/2026
[CVE-2026-85017] The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability ch…
The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable ac…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
20/09/2026
[CVE-2026-87067] The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instan…
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permission belongs to an administrator by default, and to any role the site has granted it through the Formina…
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
20/09/2026
[CVE-2026-87839] The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate…
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
20/09/2026
[CVE-2026-81650] The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate…
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability by an administrator to write arbitrary files into a web-accessible directory and, on hosts that exec…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
20/09/2026
[CVE-2026-93962] A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element …
A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element is the function shm_malloc of the file src/modules/cdp/receiver.c of the component CDP Diameter Receiver. Executing a manipulation can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Up…
nvdaltovulnerabilidad CVSS 8.3 NVD
M Alto vulnerabilidad
20/09/2026
[CVE-2026-93959] A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue a…
A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admins/assessments/course/btn_functions.php. This manipulation of the argument Course causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
nvdaltovulnerabilidad CVSS 7.3 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
19/09/2026
[CVE-2026-94056] Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers…
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
19/09/2026
[CVE-2026-93990] Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allo…
Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
19/09/2026
[CVE-2026-93991] Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArc…
Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a negated namespace field selector to retrieve archived workflows from all other namespaces, exposing spec …
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
19/09/2026
[CVE-2026-93992] Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allow…
Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory traversal sequences that bypass validation, enabling file write operations when users download and extract archives with AutoExtract enabled.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
19/09/2026
[CVE-2026-93993] Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation p…
Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
19/09/2026
[CVE-2026-94054] Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bo…
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.
nvdaltovulnerabilidad CVSS 7.0 NVD
M Alto vulnerabilidad
19/09/2026
Vulnerabilidad alta de exposición de datos en plugin YS LeadGen para WordPress (CVE-2026-1255)
El plugin YS LeadGen para WordPress en versiones hasta 2.1.4 expone datos sensibles de formularios a usuarios no autenticados a través de la acción AJAX 'ysleadgen_get_captured_data'. Atacantes pueden acceder a información personal (nombres, correos, teléfonos) recopilada en formularios de contacto y generación de leads, afectando sitios web corporativos y de marketing en LATAM. El score CVSS 7.5 indica riesgo alto para empresas que dependen de este plugin.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
19/09/2026
Vulnerabilidad alta de ejecución de shortcodes en ProfilePress para WordPress
El plugin ProfilePress para WordPress (versiones hasta 4.17.2) es vulnerable a ejecución arbitraria de shortcodes por usuarios autenticados debido a validación insuficiente antes de ejecutar do_shortcode. Esta vulnerabilidad afecta sitios de e-commerce, formularios de registro y portales de contenido restringido ampliamente utilizados en LATAM. Un atacante autenticado podría inyectar código malicioso que se ejecute en el contexto del sitio WordPress.
nvdaltovulnerabilidad CVSS 8.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
19/09/2026
Ejecución Remota de Código en plugin Welcomizer para WordPress (CVE-2026-4327)
El plugin Welcomizer para WordPress en versiones hasta 2.8.1 permite ejecución remota de código sin autenticación. La vulnerabilidad CVSS 8.8 se debe a verificación insuficiente de permisos en el manejador AJAX 'savesection' combinado con uso de eval(). Afecta directamente a sitios WordPress en México y LATAM que ejecuten este plugin sin parchear.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
19/09/2026
Vulnerabilidad XLS almacenado en plugin Quill Forms para WordPress (CVE-2026-15664)
El plugin Quill Forms versiones hasta 5.7.1 es vulnerable a inyección de scripts maliciosos (XLS) a través del campo 'Other' en formularios de opción múltiple, afectando sitios WordPress sin autenticación requerida. Atacantes pueden ejecutar código JavaScript arbitrario en navegadores de usuarios visitantes, comprometiendo datos sensibles en formularios de encuestas y cuestionarios. Impacta principalmente a sitios de comercio electrónico, educación y servicios financieros en LATAM que utilizan este plugin para recolectar información de clientes.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
19/09/2026
[CVE-2026-86814] The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirm…
The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
19/09/2026
[CVE-2026-88824] The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST rout…
The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator visiting a wp-admin page.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
19/09/2026
[CVE-2026-88926] The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise a…
The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks.
nvdaltovulnerabilidad CVSS 8.6 NVD