Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 9 min
13,434
Total alertas
3054
Críticas
10108
Altas
8
Ransomware
1740
Esta semana
RSS
Crítica × critico × Limpiar todo ×
M Crítico vulnerabilidad
09/06/2026
[CVE-2026-10045] Shenzhen Kangda Xin Intelligent Network Technology Company's router, model DR300, version 2.1.2.121,…
Shenzhen Kangda Xin Intelligent Network Technology Company's router, model DR300, version 2.1.2.121, contains hardcoded login credentials and has telnet enabled by default on WAN and LAN interfaces. These vulnerabilities allow attackers to read and write to memory, modify firmware stored in flash, inspect active connections, and view currently connected devices.
nvdcriticovulnerabilidad CVSS 9.8 NVD
A Crítico vulnerabilidad
09/06/2026
[CVE-2026-34691] Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored C…
Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control…
nvdcriticovulnerabilidad CVSS 9.3 NVD
F Crítico vulnerabilidad
09/06/2026
[CVE-2026-49840] FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary …
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, esl_recv_event() parses Content-Length with atol() and passes the result straight to malloc(len + 1) with no sign or magnitude check. A malicious or man-in-the-middle ESL peer can send a frame…
nvdcriticovulnerabilidad CVSS 9.1 NVD
F Crítico vulnerabilidad
09/06/2026
[CVE-2026-49841] FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary …
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, the mod_verto HTTP request handler allocates a fixed 2 MiB buffer for a POST application/x-www-form-urlencoded body but accepts Content-Length up to just under 10 MiB. The body-read loop is bo…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
09/06/2026
[CVE-2026-47643] External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute…
External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a network.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
09/06/2026
[CVE-2026-47291] Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code o…
Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
09/06/2026
[CVE-2026-45657] Use after free in Windows Kernel allows an unauthorized attacker to execute code over a network.
Use after free in Windows Kernel allows an unauthorized attacker to execute code over a network.
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
09/06/2026
[CVE-2026-47281] Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges ov…
Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
09/06/2026
[CVE-2026-45602] No cwe for this issue in Windows DHCP Server allows an unauthorized attacker to perform tampering ov…
No cwe for this issue in Windows DHCP Server allows an unauthorized attacker to perform tampering over a network.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
09/06/2026
[CVE-2026-44815] Stack-based buffer overflow in Windows DHCP Client allows an unauthorized attacker to execute code o…
Stack-based buffer overflow in Windows DHCP Client allows an unauthorized attacker to execute code over a network.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
09/06/2026
[CVE-2026-42904] Heap-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to elevate privileges o…
Heap-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to elevate privileges over an adjacent network.
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
09/06/2026
[CVE-2026-38615] DedeCMS V5.7.118 is vulnerable to Command Execution in file_manage_control.php.
DedeCMS V5.7.118 is vulnerable to Command Execution in file_manage_control.php.
nvdcriticovulnerabilidad CVSS 9.8 NVD
O Crítico vulnerabilidad
09/06/2026
[CVE-2026-34182] Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input val…
Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve key-equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given mess…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
09/06/2026
[CVE-2026-26142] Deserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute c…
Deserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute code over a network.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
09/06/2026
[CVE-2026-8025] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in MOSK Information Technologies Ltd. CBS Platform allows SQL Injection. This issue affects CBS Platform: through 09062026.  NOTE: The vendor was contacted and it was learned that the product is not supported.
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
I Crítico vulnerabilidad
09/06/2026
[CVE-2026-10523] An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R1…
An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
09/06/2026
[CVE-2026-7486] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Netcad Software Inc. E-İmar allows SQL Injection. This issue affects E-İmar: from 2.10.1.0 before 3.0.2.
nvdcriticovulnerabilidad CVSS 9.8 NVD
L Crítico vulnerabilidad
09/06/2026
[CVE-2026-46325] In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conver…
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct page pointers, …
nvdcriticovulnerabilidad CVSS 9.8 NVD
L Crítico vulnerabilidad
09/06/2026
[CVE-2026-46316] In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the …
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's reference on each entry with vgic_put_irq(). It puts the iterated pointer, though, rather than the value returned by xa_erase(). The functi…
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
09/06/2026
[CVE-2017-20251] WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that al…
WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the ser…
nvdcriticovulnerabilidad CVSS 9.8 NVD