Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,394
Total alertas
3047
Críticas
10075
Altas
8
Ransomware
1739
Esta semana
RSS
Crítica × cwe-89 × Limpiar todo ×
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-39493] Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.
Unauthenticated SQL Injection in Simply Schedule Appointments
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-39441] Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions.
Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-50890] Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-gro…
Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /stockreports/spendings. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-48114] Metacat is data repository software that helps researchers preserve, share, and discover data. Versi…
Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL injection in the /harvesterRegistration endpoint. HarvesterRegistration.dbInsert() builds an INSERT against HARVEST_SITE_SCHEDULE via string concatenation, using a quoteString() helper that performs raw single-quote wrapping without escaping. Th…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-38812] RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affect…
RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affects the code generation module and may allow an authenticated attacker with administrative privileges to access sensitive database information.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-39196] Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_q…
Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_query parameter in the KeyPartitioner::partition function. This vulnerability allows attackers to access sensitive database information via crafted SQL statements.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
12/06/2026
[CVE-2026-44172] MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an appli…
MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in…
nvdcriticovulnerabilidad CVSS 9.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
11/06/2026
[CVE-2026-45060] ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/p…
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injection. Any unauthenticated user can exploit the ids parameter to execute SQL queries and exfiltrate sensitive data. This issue has been patched in version 5.5.3 - #129.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
11/06/2026
[CVE-2026-39494] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW allows Blind SQL Injection. This issue affects Product Filter by WBW: from n/a through 3.1.2.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
11/06/2026
[CVE-2026-42647] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beardev JoomSport allows Blind SQL Injection. This issue affects JoomSport: from n/a through 5.7.7.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
11/06/2026
[CVE-2026-38581] SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote attacker…
SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote attackers to execute arbitrary SQL commands via the idFormMain parameter to /substudy/ezform.php (line 14) and the id parameter (line 49). The parameters are concatenated directly into SQL queries without sanitization or parameterized statements.
nvdcriticovulnerabilidad CVSS 9.8 NVD
K Crítico vulnerabilidad
10/06/2026
[CVE-2026-53474] A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerabil…
A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. This SQL Injection allows for arbitrary file reading on the system, potentially exposing sensitive information s…
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
09/06/2026
[CVE-2026-8025] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in MOSK Information Technologies Ltd. CBS Platform allows SQL Injection. This issue affects CBS Platform: through 09062026.  NOTE: The vendor was contacted and it was learned that the product is not supported.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
09/06/2026
[CVE-2026-7486] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Netcad Software Inc. E-İmar allows SQL Injection. This issue affects E-İmar: from 2.10.1.0 before 3.0.2.
nvdcriticovulnerabilidad CVSS 9.8 NVD
B Crítico vulnerabilidad
05/06/2026
[CVE-2026-45779] OpenXDMoD is an open framework for collecting and analyzing HPC metrics. An SQL injection vulnerabil…
OpenXDMoD is an open framework for collecting and analyzing HPC metrics. An SQL injection vulnerability exists in Open XDMoD versions prior to 10.0.3 that allows an unauthenticated remote attacker to execute arbitrary SQL statements. Exploitation requires no authentication or user interaction and can result in complete compromise of the underlying database. All deployments of Open XDMoD prior to 1…
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
04/06/2026
[CVE-2026-10880] OSNexus QuantaStor SDS Manager is vulnerable to SQL injection in the login endpoint. The username fi…
OSNexus QuantaStor SDS Manager is vulnerable to SQL injection in the login endpoint. The username field is not properly sanitized before being incorporated into a SQL query, allowing an unauthenticated remote attacker to bypass authentication and log in as an administrator without supplying a valid password.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
04/06/2026
[CVE-2026-4104] Authorization bypass through User-Controlled SQL primary key vulnerability in Akmer Informatics Auto…
Authorization bypass through User-Controlled SQL primary key vulnerability in Akmer Informatics Automation Industry and Trade Ltd. Co. TeknoPass allows SQL Injection. This issue affects TeknoPass: from 20210501 through 20260429.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
02/06/2026
[CVE-2026-42684] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ahmad WP Job Portal allows Blind SQL Injection. This issue affects WP Job Portal: from n/a through 2.5.1.
nvdcriticovulnerabilidad CVSS 9.3 NVD