Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 1 hora
22,093
Total alertas
4671
Críticas
16834
Altas
8
Ransomware
1003
Esta semana
RSS
Crítica × cwe-843 × Limpiar todo ×
M Crítico vulnerabilidad
Hace 3 días
[CVE-2026-106446] Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.…
Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST validation introduced in version 4.7.9 for CVE-2026-33937. An attacker who can supply an object inst…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
02/10/2026
[CVE-2026-104846] Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify cap…
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger co…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
20/09/2026
[CVE-2026-94083] Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code…
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.
nvdcriticovulnerabilidad CVSS 9.4 NVD
M Crítico vulnerabilidad
11/09/2026
[CVE-2026-71644] An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef12345678…
An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause unsafe trajectory planning and potential UAV collisions via a missing default case in the FSM that stops publishing swarm trajectories when the drone enters IDLE
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
10/09/2026
[CVE-2026-45764] Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M…
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a protocol change while processing HTTP/2 traffic could lead to type confusion in Suricata. Crafted traffic may cause Suricata to crash, resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable HTTP/2 pars…
nvdcriticovulnerabilidad CVSS 9.1 NVD
G Crítico vulnerabilidad
09/09/2026
[CVE-2026-87528] Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attack…
Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
25/08/2026
[CVE-2026-78904] Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potenti…
Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
nvdcriticovulnerabilidad CVSS 9.6 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-16919] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod…
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper validation of network-supplied pointers.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
18/08/2026
[CVE-2026-59940] Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify cap…
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potenti…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
18/08/2026
[CVE-2026-74956] Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Fir…
Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2026-17697] Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potenti…
Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2026-17687] Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had co…
Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvdcriticovulnerabilidad CVSS 9.6 NVD
A Crítico vulnerabilidad
27/07/2026
[CVE-2026-64727] A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Tah…
A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Tahoe 26.6, tvOS 26.6. An app may be able to cause unexpected system termination.
nvdcriticovulnerabilidad CVSS 9.8 NVD
A Crítico vulnerabilidad
27/07/2026
[CVE-2026-64704] A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Seq…
A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
21/07/2026
[CVE-2026-16410] JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox …
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
21/07/2026
[CVE-2026-16392] JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox …
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
21/07/2026
[CVE-2026-16355] JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox …
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
21/07/2026
[CVE-2026-16363] JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox…
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
21/07/2026
[CVE-2026-64608] Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deseria…
Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of A…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
03/07/2026
[CVE-2026-58289] Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) all…
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
nvdcriticovulnerabilidad CVSS 9.0 NVD