Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Ui" — 669 resultados ✕ Limpiar búsqueda
22,181
Total alertas
4701
Críticas
16892
Altas
8
Ransomware
1052
Esta semana
RSS
Crítica × Limpiar todo ×
O Crítico vulnerabilidad
17/06/2026
[CVE-2026-46902] Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (…
Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). Supported versions that are affected are V15 and V16. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Command Center Framework. Successful attacks of this vulnerability can result in takeover of Oracl…
nvdcriticovulnerabilidad CVSS 9.8 NVD
O Crítico vulnerabilidad
17/06/2026
[CVE-2026-46856] Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (c…
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person other…
nvdcriticovulnerabilidad CVSS 9.6 NVD
O Crítico vulnerabilidad
17/06/2026
[CVE-2026-46853] Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (c…
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person other…
nvdcriticovulnerabilidad CVSS 9.6 NVD
O Crítico vulnerabilidad
17/06/2026
[CVE-2026-46805] Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten…
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the v…
nvdcriticovulnerabilidad CVSS 9.3 NVD
O Crítico vulnerabilidad
17/06/2026
[CVE-2026-46807] Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI)…
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Bas…
nvdcriticovulnerabilidad CVSS 9.8 NVD
O Crítico vulnerabilidad
17/06/2026
[CVE-2026-46795] Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten…
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the v…
nvdcriticovulnerabilidad CVSS 9.3 NVD
O Crítico vulnerabilidad
17/06/2026
[CVE-2026-46785] Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten…
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the v…
nvdcriticovulnerabilidad CVSS 9.3 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
O Crítico vulnerabilidad
17/06/2026
[CVE-2026-46786] Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten…
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the v…
nvdcriticovulnerabilidad CVSS 9.6 NVD
O Crítico vulnerabilidad
17/06/2026
[CVE-2026-46789] Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten…
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the v…
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
16/06/2026
[CVE-2026-49772] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-42381] Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions.
Unauthenticated SQL Injection in Funnel Builder by FunnelKit
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-48114] Metacat is data repository software that helps researchers preserve, share, and discover data. Versi…
Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL injection in the /harvesterRegistration endpoint. HarvesterRegistration.dbInsert() builds an INSERT against HARVEST_SITE_SCHEDULE via string concatenation, using a quoteString() helper that performs raw single-quote wrapping without escaping. Th…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-52704] Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce P…
Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code Inclusion. This issue affects WooCommerce PDF Invoice Builder: from n/a through 2.0.8.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-8935] The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given …
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin access.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
12/06/2026
[CVE-2026-41157] A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trig…
A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound write in the GPU user-space driver, leading to memory corruption and possible browser/GPU process crash. The software computes a required memory size from untrusted input, but integer overflow can produce a value smaller than needed. Subsequent write operations may then occur …
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
A Crítico vulnerabilidad
12/06/2026
[CVE-2026-50086] The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the p…
The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing key without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and "CWE-327: Use of a Broken or Risky Cryptographic Algorithm," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 High).
nvdcriticovulnerabilidad CVSS 10.0 NVD
A Crítico vulnerabilidad
12/06/2026
[CVE-2026-50090] The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) is vulnerable to a …
The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) is vulnerable to a redirect bypass due to lax controls on domain matching, which is an instance of "CWE-1289: Improper Validation of Unsafe Equivalence in Input" and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N (9.3 Critical).
nvdcriticovulnerabilidad CVSS 9.3 NVD
A Crítico vulnerabilidad
12/06/2026
[CVE-2026-50091] Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients embedding the same libl…
Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients embedding the same liblumidevsdk.so) uses hard-coded cryptographic keys, which is an instance of "CWE-321: Use of Hard-coded Cryptographic Key" and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical).
nvdcriticovulnerabilidad CVSS 9.1 NVD
A Crítico vulnerabilidad
12/06/2026
[CVE-2026-50083] The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is …
The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-coded Credentials." This issue has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical). When combined with CVE-2026-50082, CVE-50084, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.
nvdcriticovulnerabilidad CVSS 9.1 NVD
A Crítico vulnerabilidad
12/06/2026
[CVE-2026-50084] The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer…
The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer token for access to any account. This is an instance of "CWE-862: Missing Authorization" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N (9.6 Critical). When combined with CVE-2026-50082, CVE-50083, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of a…
nvdcriticovulnerabilidad CVSS 9.6 NVD