Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 48 min
22,340
Total alertas
4744
Críticas
16966
Altas
8
Ransomware
1210
Esta semana
RSS
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-105859] Payload is a free and open source headless content management system. In versions before 3.90.0 and …
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control when orderable is enabled on a collection or join field. This issue is fixed in versions 3.90.0 and 4.0…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-104070] The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows …
The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorization dispatcher to resolve an unconditionally-true handler instead of the proper modification check. Attackers can chain this flaw to write a m…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-67273] Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of S…
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-105845] Payload is a free and open source headless content management system. In versions from 3.0.0 before …
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection in the SQLite and Postgres adapters. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-63692] Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Cr…
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-67269] Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privile…
Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could potentially exploit this vulnerability, leading to escalation of privileges and gaining root-level access on cluster nodes.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-54472] Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credential…
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the csm-docs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.9.8
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-61421] Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credential…
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-63688] Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication f…
Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to storage backend administrator credentials for all registered storage arrays.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-91140] An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Prog…
An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's machine when a user invokes the generator.
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-77178] Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host …
Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-106037] Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST serv…
Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove_all and /api/mount to read cached KV data with user prompts, inject or delete objects, and mount attacker-described segments.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-42415] Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.
Unauthenticated SQL Injection in Porto Theme - Functionality
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-42417] Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.
Unauthenticated SQL Injection in ARMember Premium
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-41555] Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Ema…
Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email
nvdcriticovulnerabilidad CVSS 9.3 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-39795] Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions.
Unauthenticated SQL Injection in SendPress Newsletters
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-39797] Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.
Unauthenticated PHP Object Injection in GDPR Framework By Data443
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-39785] Unauthenticated SQL Injection in Gmedia Photo Gallery <= 1.25.1 versions.
Unauthenticated SQL Injection in Gmedia Photo Gallery
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-39770] Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.
Unauthenticated Arbitrary File Upload in Doctreat
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
Hace 4 días
[CVE-2026-39773] Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.
Unauthenticated Privilege Escalation in Doctreat Core
nvdcriticovulnerabilidad CVSS 10.0 NVD