Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,181
Total alertas
4701
Críticas
16892
Altas
8
Ransomware
1055
Esta semana
RSS
Crítica × 30 días × Limpiar todo ×
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-102115] Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An u…
Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-102102] Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery…
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway retrieves…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-102103] Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery…
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway retrieves…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-102104] Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery…
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway performs …
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-102105] Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery…
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway renders m…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-102106] Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administr…
Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid administrator account could potentially create, modify, or delete internal users and managed domains and…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-102095] Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery…
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote, unauthenticated sender could craft a message that caused the gateway to issue requests to internal services and cl…
nvdcriticovulnerabilidad CVSS 9.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-55107] Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing exe…
Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated code, user formulas, student submissions, third-party plugins) in-process without giving them access to host memory, files, network, or credentials. From version 0.1.0 to before version 0.9.1, a guest mruby script running inside the Kobako sandbox can …
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-103475] yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting …
yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-100512] Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.
Contributor PHP Object Injection in Nested Pages
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-62308] Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6,…
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/test_notification endpoint accepts a urls field and passes it directly to Apprise without restricting protocols, hostna…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-55494] Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4,…
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENT_SECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py, the signature verification function returns successfully if Config.AGENT_SECRET is empty. This causes …
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-55176] Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.…
Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, two authentication helpers in /app/server.js — verifyContainerAuth() and authenticateWorkspaceHttp() — accept the global CONTAINER_SHARED_SECRET as a bearer token without verifying which workspace the caller belongs to. Because that secret is set identically on every container in the …
nvdcriticovulnerabilidad CVSS 9.0 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-55181] Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3,…
Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDC_ENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled. However, a direct request to /auth/oidc/login still starts the OIDC login flow, returns HTTP 302, sets an oidc_state cookie, and redirects th…
nvdcriticovulnerabilidad CVSS 9.4 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-18782] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29.
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-103395] LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pic…
LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the visual RPyC port and pass objects with __reduce__ methods to execute arbitrary code with service account privileges.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-82307] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection. This issue affects SOPLOG: before Soplog 2026.9.4.1.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-97274] Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.
Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client)
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-97248] Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.
Unauthenticated PHP Object Injection in Booking Activities
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/09/2026
[CVE-2026-96822] Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.
Unauthenticated SQL Injection in Books Gallery
nvdcriticovulnerabilidad CVSS 9.3 NVD