Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,434
Total alertas
3054
Críticas
10108
Altas
8
Ransomware
1778
Esta semana
RSS
Alta × cwe-288 × Limpiar todo ×
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-66677] Subscriber Broken Authentication in Leyka <= 3.32.3 versions.
Subscriber Broken Authentication in Leyka
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
Hace 5 días
[CVE-2026-50191] 4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerabl…
4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO is configured. The POST /api/register endpoint permits creation of an unverified local account with a victim's email address, and POST /api/…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
Hace 5 días
[CVE-2026-24185] NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configura…
NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is enabled, where an administrator could inadvertently enable an alternative authentication path. If best practices for replacing the default password as recommended by NVIDIA are not followed, this alternative authentication path might lead to unauthorized access.…
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
Hace 5 días
[CVE-2026-73396] Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions.
Subscriber Broken Authentication in MWB HubSpot for WooCommerce
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
Hace 5 días
[CVE-2026-32481] Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.
Unauthenticated Broken Authentication in Ezoic
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
13/08/2026
[CVE-2026-73188] Unauthenticated Sensitive Data Exposure in KiviCare <= 4.5.1 versions.
Unauthenticated Sensitive Data Exposure in KiviCare
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
12/08/2026
[CVE-2026-70468] A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.…
A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, FortiManager 7.4.3 through 7.4.5, FortiManager 7.2.5 through 7.2.9, FortiManager Cloud 7.6.1, FortiManager Cloud 7.4.3 through 7.4.5, FortiManager Cloud 7.2.5 through 7.2.9 may allow attacker to improper access control via
nvdaltovulnerabilidad CVSS 8.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
10/08/2026
[CVE-2026-72691] An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unaut…
An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever any docId parameter is supplied, even one corresponding to no real document, allowing the authentication…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
06/08/2026
[CVE-2026-65542] Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.
Unauthenticated Broken Authentication in Super Socializer
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
03/08/2026
[CVE-2026-68584] SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where c…
SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retrieve full content of password-protected documents by obtaining internal block IDs from reader-accessible …
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
29/07/2026
[CVE-2026-12703] TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that c…
TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to bypass a configured 2FA for Connections approval flow via Unattended Access and establish a remote connection to an affected macOS host.
nvdaltovulnerabilidad CVSS 8.0 NVD
M Alto vulnerabilidad
23/07/2026
[CVE-2026-59545] Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.
Unauthenticated Broken Authentication in miniOrange Discord Integration
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
13/07/2026
[CVE-2026-57697] Authentication Bypass Using an Alternate Path or Channel vulnerability in Metagauss ProfileGrid pro…
Authentication Bypass Using an Alternate Path or Channel vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Password Recovery Exploitation.This issue affects ProfileGrid : from n/a through
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
01/07/2026
[CVE-2026-12579] AS228T with Authentication Bypass Vulnerability
AS228T with Authentication Bypass Vulnerability
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-56029] Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions.
Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway
nvdaltovulnerabilidad CVSS 7.5 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
23/06/2026
[CVE-2026-56243] Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane…
Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforce_hashed_api_keys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext API keys directly to the PostgREST/RLS plane to access protected resources.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
20/06/2026
[CVE-2020-37255] WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows un…
WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by sending a crafted POST request with the IWP_JSON_PREFIX header. Attackers can exploit this flaw to obtain valid administrator session cookies and access the WordPress dashboard without providing credentials.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
17/06/2026
[CVE-2026-50194] Steeltoe is an open source project that provides a collection of libraries that helps users build cl…
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. When Steeltoe management endpoints versions 3.2.2 through 3.3.0 and 4.1.0 are configured to listen on an alternate port (`Management:Endpoints:Port` is configured), the middleware responsible for restricting access to the endpoints uses the `Host` HTTP header rather than the…
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
17/06/2026
[CVE-2026-54804] Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions.
Subscriber Broken Authentication in Melhor Envio
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
17/06/2026
[CVE-2026-42629] Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.
Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.
nvdaltovulnerabilidad CVSS 8.8 NVD