Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,395
Total alertas
4758
Críticas
17006
Altas
8
Ransomware
1254
Esta semana
RSS
G Crítico vulnerabilidad
30/06/2026
[CVE-2026-13792] Use after free in Touchbar in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker …
Use after free in Touchbar in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
nvdcriticovulnerabilidad CVSS 9.6 NVD
G Crítico vulnerabilidad
30/06/2026
[CVE-2026-13775] Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had comp…
Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
nvdcriticovulnerabilidad CVSS 9.8 NVD
G Crítico vulnerabilidad
30/06/2026
[CVE-2026-13776] Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had com…
Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
nvdcriticovulnerabilidad CVSS 9.8 NVD
G Crítico vulnerabilidad
30/06/2026
[CVE-2026-13780] Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed …
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
nvdcriticovulnerabilidad CVSS 9.6 NVD
G Crítico vulnerabilidad
30/06/2026
[CVE-2026-13781] Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a…
Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
30/06/2026
[CVE-2026-58449] txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint whose function body …
txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint whose function body parameter is resolved through txtai.util.Resolver, which performs __import__ and getattr on the caller-supplied dotted path with no allowlist. When the API is exposed with no TOKEN configured (authentication is opt-in, so all endpoints are unauthenticated) and the index is configured writable, a rem…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/06/2026
[CVE-2026-50003] A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode wr…
A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
30/06/2026
[CVE-2026-37106] An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via …
An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php. NOTE: this is disputed by the Supplier because this is the intentional behavior when the product is configured for self-registration (a non-default feature). The supplier also notes that there is no configuration migration scenario that would result in the self…
nvdcriticovulnerabilidad CVSS 9.8 NVD
L Crítico vulnerabilidad
30/06/2026
[CVE-2026-7663] IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP p…
IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.
nvdcriticovulnerabilidad CVSS 9.1 NVD
L Crítico vulnerabilidad
30/06/2026
[CVE-2026-7803] IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validatio…
IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields.
nvdcriticovulnerabilidad CVSS 9.8 NVD
L Crítico vulnerabilidad
30/06/2026
[CVE-2026-7871] IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with …
IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with full application privileges, compromising all secrets, data, and system integrity.
nvdcriticovulnerabilidad CVSS 9.8 NVD
L Crítico vulnerabilidad
30/06/2026
[CVE-2026-7873] IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS command…
IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.
nvdcriticovulnerabilidad CVSS 9.9 NVD
L Crítico vulnerabilidad
30/06/2026
[CVE-2026-7874] IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due …
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due to the use of a weak and reversible key derivation mechanism for encryption at rest.
nvdcriticovulnerabilidad CVSS 9.1 NVD
L Crítico vulnerabilidad
30/06/2026
[CVE-2026-10140] IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows…
IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to be processed using incorrect upstream API credentials, leading to cross-tenant billing and accountability misattribution.
nvdcriticovulnerabilidad CVSS 9.6 NVD
I Crítico vulnerabilidad
30/06/2026
[CVE-2026-11708] IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in…
IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system.
nvdcriticovulnerabilidad CVSS 9.3 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
I Crítico vulnerabilidad
30/06/2026
[CVE-2026-11712] IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in…
IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system.
nvdcriticovulnerabilidad CVSS 9.3 NVD
I Crítico vulnerabilidad
30/06/2026
[CVE-2026-10109] IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due …
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling.
nvdcriticovulnerabilidad CVSS 9.8 NVD
L Crítico vulnerabilidad
30/06/2026
[CVE-2026-10134] IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langfl…
IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read and modify every flow, conversation, message, file upload, and saved component in the Langflow database, can connect to internal services, abuse cloud metadata endpoints, laterally move to other tenants on the same Langflow instance, and Establish persistence by modifying the public…
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
30/06/2026
[CVE-2026-58138] Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerabilit…
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/06/2026
[CVE-2026-58172] Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability tha…
Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability that allows denied clients to circumvent IP-based access restrictions by sending WebSocket upgrade requests. The WebSocket upgrade pipeline branch configured via MapWhen in OcelotPipelineExtensions.cs omits SecurityMiddleware, causing requests from blocked IP addresses to be proxied to downstream servi…
nvdcriticovulnerabilidad CVSS 9.1 NVD