Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,162
Total alertas
4698
Críticas
16876
Altas
8
Ransomware
1045
Esta semana
RSS
Crítica × cwe-693 × Limpiar todo ×
M Crítico vulnerabilidad
Hace 1 día
[CVE-2026-16916] IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 …
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary code due to a protection mechanism failure.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
25/09/2026
[CVE-2026-39353] InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. …
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted by Mdl_templates and can be selected as publi…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
18/09/2026
[CVE-2026-93605] vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTIN…
vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host system when NodeVM is configured with builtin:['*'] or explicit child_process allowance.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
18/09/2026
[CVE-2026-93606] vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`. When an embedde…
vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`. When an embedder exposes a host API that returns a host-realm Promise, the bridge's rejection sanitizer (hostPromiseSanitizeReject / makeSanitizedPromiseCallback / normalizeHostPromiseCallbacks in lib/bridge.js) only wraps `then`/`catch` rejection slots that hold a function, and the sandbox-side `Symbol.species`/`…
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-92956] vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sand…
vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host-realm error object; by controlling Symbol.species via Promise.prototype.finally, sandbox code receives that raw host error, walks from the h…
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-92948] vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a…
vm2 versions >= 3.9.6 and
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-92944] vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promis…
vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally() bypasses vm2's wrapper protections due to a stale PromiseThenLookupChain protector in V8 14.6. Attackers can exploit this by creating an async function that returns a Promise with an attacker-controlled constructor Symbol.species, allowing them to reach the host Function constr…
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-92938] vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeV…
vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ['*']. The module is wrapped with vm.readonly(), which prevents property assignment but leaves host-authority callables reachable; in addition, the resolver treats any request starting with 'node:' as a core-module request and t…
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-92934] vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape…
vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized host proxies embedded in the errors array, enabling full remote code execution and process information dis…
nvdcriticovulnerabilidad CVSS 9.0 NVD
M Crítico vulnerabilidad
16/09/2026
[CVE-2026-20331] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Ad…
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally disc…
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
15/09/2026
[CVE-2026-53710] MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to …
MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py exposes raw getattr through safe_builtins, omits a required _getattr_ guard, and relies on validate_code checks for literal dangerous dunder strings. An attacker can construct dun…
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
15/09/2026
[CVE-2026-91949] FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allow…
FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
15/09/2026
Vulnerabilidad crítica en PraisonAI permite ejecución remota de código malicioso
PraisonAI versiones 1.4.0 a 1.7.2 contienen una vulnerabilidad de ejecución de código no autorizado (CVSS 9.9) en el módulo code-mode.ts. Un atacante puede eludir el sandbox de JavaScript utilizando técnicas de prototipado para recuperar el constructor Function real y acceder a process, comprometiendo completamente sistemas que ejecuten agentes multi-IA. Este riesgo afecta directamente a empresas en LATAM que implementan automatización con PraisonAI en entornos productivos.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
09/09/2026
[CVE-2026-54694] SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code fl…
SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. `StringHighlighter.js` builds an HTML string by interpolating raw `value` substrings directly into a template literal with no HTML entity encoding. `HighlightedValue.vue` renders that str…
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
08/09/2026
[CVE-2026-81376] Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to …
Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
nvdcriticovulnerabilidad CVSS 9.6 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-82855] @hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudf…
@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origins, or repositories to bypass security guardrails for unrelated resources in the same stack.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
18/08/2026
[CVE-2026-75874] Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 …
Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbird 154.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
18/08/2026
[CVE-2026-74938] Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Fire…
Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
17/08/2026
[CVE-2026-47686] vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbo…
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain a powerful host object such as process from an embedder-exposed host function that throws an error with that object as its cause and then exe…
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
17/08/2026
Vulnerabilidad crítica en openssl_encrypt: ejecución de plugins sin restricciones de sandbox
Las versiones de openssl_encrypt anteriores a 1.4.0 no aplican restricciones de aislamiento en la ejecución de plugins, permitiendo a atacantes acceder sin límites al sistema de archivos, red, subprocesos y módulos Python. Esta vulnerabilidad afecta directamente a servidores en LATAM que procesan encriptación y ejecutan plugins dinámicos, comprometiendo la confidencialidad e integridad de datos sensibles.
nvdcriticovulnerabilidad CVSS 9.8 NVD