Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Multiple Vendors" — 3573 resultados ✕ Limpiar búsqueda
22,298
Total alertas
4744
Críticas
16966
Altas
8
Ransomware
1168
Esta semana
RSS
Crítica × Limpiar todo ×
M Crítico vulnerabilidad
03/07/2026
[CVE-2026-9725] The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Ar…
The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the store_design_data() function, which constructs a filesystem path from the user-supplied 'nbd_item_key' POST parameter sanitized only with sanitize_text_field() — which does not strip path…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
03/07/2026
[CVE-2026-13768] Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user t…
Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a malicious user to execute arbitrary commands on a specific connected device and may allow the malicious user to pivot to other devices on the…
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
02/07/2026
[CVE-2026-52830] fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer…
fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The verifier rejects the exact reserved token telegram, but it does not reject path separators or normalize the path before checking whether the session file exists. A remote HTTP client can therefore authenticate as the default legac…
nvdcriticovulnerabilidad CVSS 9.4 NVD
M Crítico vulnerabilidad
02/07/2026
[CVE-2026-59099] Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthen…
Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers to recover plaintext conversation state by exploiting AES-GCM initialization vector reuse across the server lifetime. Attackers can collect multiple client-side webflow execution tokens from the unauthenticated login page and perform known-plaintext analysis to decrypt the webflow …
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
02/07/2026
[CVE-2026-58466] AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthe…
AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via add_default_user() in the database user module when the users table is empty. Attackers can submit the default credentials to the authentication login endpoint to gain full c…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
02/07/2026
[CVE-2024-14037] Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attacke…
Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading malicious files through the PtFjk.mob servlet endpoint. Attackers can submit a multipart POST request with a JSP webshell disguised using a spoofed image/jpeg Content-Type to bypass the absence of extension and MIME type validation, with the uploaded …
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
02/07/2026
[CVE-2022-50973] Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bi…
Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filename parameters without any authentication, file type, extension, or content validation. Attackers can upload a JSP webshell by specifying a m…
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
02/07/2026
[CVE-2026-58455] Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows…
Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands by exploiting a missing exit() after an authentication redirect in loader.php combined with unsanitized input passed to shell_exec() in ajax/compose.php. Attackers can seed the required session flag through the incomplete auth check, then inject …
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
02/07/2026
[CVE-2026-56004] A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12…
A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as the source service or the local user checking out the malicious services
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
02/07/2026
[CVE-2026-4767] Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc. WAF-ASP allow…
Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc. WAF-ASP allows Authentication Abuse. This issue affects WAF-ASP: from v1.0.324.900 before v1.4.0.117.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
02/07/2026
[CVE-2026-5524] The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote …
The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the do_image_upload() function where user-supplied input from the acceptFileTypes POST parameter is directly interpolated into a regular expression used to validate uploaded files. Atta…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
02/07/2026
[CVE-2026-57683] Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions.
Unauthenticated SQL Injection in WP Fast Total Search
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
02/07/2026
[CVE-2026-57677] Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10.3 versions…
Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
02/07/2026
[CVE-2026-57679] Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions.
Unauthenticated SQL Injection in GeekyBot
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
02/07/2026
[CVE-2026-57621] Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions.
Unauthenticated PHP Object Injection in Booktics
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
02/07/2026
[CVE-2026-57623] Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions.
Unauthenticated Arbitrary Code Execution in W3 Total Cache
nvdcriticovulnerabilidad CVSS 9.0 NVD
M Crítico vulnerabilidad
02/07/2026
[CVE-2026-57624] Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.
Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
02/07/2026
[CVE-2026-57625] Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8.5 version…
Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
02/07/2026
[CVE-2026-27436] Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions.
Editor Arbitrary Code Execution in Five Star Business Profile and Schema
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
02/07/2026
[CVE-2026-27419] Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions.
Subscriber Arbitrary File Upload in Zegen
nvdcriticovulnerabilidad CVSS 9.9 NVD