Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,093
Total alertas
4671
Críticas
16834
Altas
8
Ransomware
1023
Esta semana
RSS
Crítica × cwe-94 × Limpiar todo ×
M Crítico vulnerabilidad
23/09/2026
[CVE-2026-77602] OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or mor…
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targets_modified/ that is later executed by multiple configuration paths below the intended code-execution privilege tier. Table and command or telemetry definitions are processed through Config…
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
23/09/2026
[CVE-2026-96758] orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer …
orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject ${...} expressions into OpenAPI schema property names that execute as live interpolation when the generated client builds FormData bodies with consumer process privileges.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
23/09/2026
[CVE-2026-96759] orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanSta…
orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
23/09/2026
[CVE-2026-96754] orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator tha…
orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that executes when the generated TypeScript module is imported.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
23/09/2026
[CVE-2026-96755] orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect gen…
orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
23/09/2026
[CVE-2026-96757] orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Co…
orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolvers are invoked.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
23/09/2026
[CVE-2026-75799] The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it …
The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled.
nvdcriticovulnerabilidad CVSS 9.0 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
22/09/2026
[CVE-2026-18162] IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execut…
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
22/09/2026
[CVE-2026-89275] Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injecti…
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
22/09/2026
[CVE-2026-89276] Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injecti…
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
22/09/2026
[CVE-2026-84412] Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injecti…
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
22/09/2026
[CVE-2026-75721] Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injecti…
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
22/09/2026
[CVE-2026-73369] Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injecti…
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
22/09/2026
[CVE-2026-75699] Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injecti…
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
22/09/2026
[CVE-2026-75703] Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injecti…
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
nvdcriticovulnerabilidad CVSS 10.0 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
20/09/2026
[CVE-2026-90817] An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing a…
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by supplying a crafted file-path/stream parameter during import handling. If successfully exploited, this co…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
19/09/2026
Vulnerabilidad crítica de escape de sandbox en OpenPanel js-runtime (CVE-2026-93985)
OpenPanel js-runtime contiene una vulnerabilidad de escape de sandbox (CVSS 9.9) en el validador de plantillas webhook de JavaScript que permite a atacantes con acceso de escritura al proyecto ejecutar código arbitrario mediante notación de propiedad computada para acceder a la cadena de constructores. Esta falla afecta principalmente a empresas que utilizan OpenPanel para orquestación de aplicaciones y webhooks en entornos críticos de México y Latinoamérica.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
19/09/2026
Vulnerabilidad crítica en plugin Forminator para WordPress permite ejecución arbitraria de shortcodes
El plugin Forminator Forms para WordPress (versiones hasta 1.57.2) es vulnerable a ejecución arbitraria de shortcodes debido a validación insuficiente en la función do_shortcode. Atacantes no autenticados pueden ejecutar código malicioso en sitios web afectados, comprometiendo la integridad de formularios de contacto y pago. Esta vulnerabilidad impacta directamente a empresas en LATAM que utilizan este plugin en formularios críticos de recolección de datos y procesamiento de pagos.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
19/09/2026
Vulnerabilidad crítica en WP Recipe Maker: ejecución arbitraria de shortcodes en WordPress
El plugin WP Recipe Maker para WordPress (versiones hasta 10.8.1) permite la ejecución arbitraria de shortcodes a través del campo reviewBody en metadatos de recetas. Un atacante puede inyectar código malicioso mediante comentarios que se procesan sin sanitización adecuada, comprometiendo sitios web de empresas, blogs corporativos y plataformas de contenido culinario en LATAM. El impacto afecta la integridad del contenido y puede derivar en acceso no autorizado a datos sensibles.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
18/09/2026
[CVE-2026-82340] IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and atta…
IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispatch in the Change Audit System (CAS) listener. A network attacker able to reach TCP port 16017 may submit crafted serialized messages and potentially cause unintended code execution in the Guardium appliance.
nvdcriticovulnerabilidad CVSS 9.8 NVD