Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,454
Total alertas
4765
Críticas
17048
Altas
8
Ransomware
1254
Esta semana
RSS
Crítica × Limpiar todo ×
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-65574] Unauthenticated PHP Object Injection in Abogado <= 1.18 versions.
Unauthenticated PHP Object Injection in Abogado
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-65552] Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.
Subscriber PHP Object Injection in Export User Data
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-65553] Unauthenticated Remote Code Execution (RCE) in Spider Analyser &#8211; WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 …
Unauthenticated Remote Code Execution (RCE) in Spider Analyser &#8211; WordPress搜索引擎蜘蛛分析插件
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-65556] Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.
Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam}
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-65546] Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.
Unauthenticated SQL Injection in Qode Tours
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-65548] Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.
Contributor Remote Code Execution (RCE) in Betheme
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-65520] Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.
Unauthenticated SQL Injection in WP OAuth Server
nvdcriticovulnerabilidad CVSS 9.3 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-65507] Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.
Unauthenticated Privilege Escalation in AIWU
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-65508] Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.
Unauthenticated SQL Injection in Simply Schedule Appointments
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-54489] Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a…
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This vulnerability is considered critical as it allows an unauthenticated attacker to obtain active session crede…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-53975] OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remot…
OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn() without any allowlist, blocklist, or argument validation. The authentication middleware becomes a no-op when UI_PASSWORD is not configured,…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-53976] OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/rea…
OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassing the workspace boundary check in resolveReadPathFromContext. Attackers can exploit the vacuous isPath…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-32327] A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library co…
A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-34191] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-28139] Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.
Unauthenticated PHP Object Injection in Ajax Search Lite
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-28005] Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.
Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-5134] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection. This issue affects CMS: through 06082026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-12605] In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leak…
In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is authenticated into the Admin Console -\> full unauthenticated takeover of Eclipse GlassFish domain until the token expires.
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-68079] In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an …
In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once." Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-61466] In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and st…
In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this…
nvdcriticovulnerabilidad CVSS 9.1 NVD