Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,082
Total alertas
4667
Críticas
16827
Altas
8
Ransomware
1014
Esta semana
RSS
Alta × cwe-502 × Limpiar todo ×
M Alto vulnerabilidad Nuevo
Hace 3 horas
[CVE-2026-94064] Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme ne…
Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad Nuevo
Hace 3 horas
[CVE-2026-94065] Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Inj…
Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: from n/a through 1.3.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad Nuevo
Hace 4 horas
[CVE-2026-104392] Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-ne…
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad Nuevo
Hace 4 horas
[CVE-2026-105872] Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce pr…
Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad Nuevo
Hace 7 horas
[CVE-2026-94568] Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-…
Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.0.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
Hace 1 día
[CVE-2026-105436] Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object In…
Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a through 6.2.1.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
Hace 1 día
[CVE-2026-82627] The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Inc…
The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object when a third-party integration plu…
nvdaltovulnerabilidad CVSS 7.5 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
Hace 2 días
[CVE-2026-95534] Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Element…
Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Object Injection. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
Hace 2 días
[CVE-2026-106558] Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, t…
Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation source may bypass TechDocs sanitization and cause Python objects to be imported and instantiated in the…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
Hace 2 días
[CVE-2026-97188] The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserial…
The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and saves that row. If a suitable POP chain is present via another installed String locator WordPress plug…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
Hace 2 días
[CVE-2026-93447] IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and R…
IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized cache value. When the value was retrieved, deserialization could have executed attacker-controlled code with the privileges of the service process.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
Hace 2 días
[CVE-2026-65142] NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untru…
NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-104747] Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.
Unauthenticated PHP Object Injection in Haaken
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-82988] There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unkno…
There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-97257] Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-pla…
Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7.
nvdaltovulnerabilidad CVSS 8.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-93617] Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-ca…
Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-103348] Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate…
Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-100511] Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-goog…
Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-100506] Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allo…
Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from n/a through 12.1.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-103349] Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce wo…
Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7.
nvdaltovulnerabilidad CVSS 7.2 NVD