Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Ni" — 893 resultados ✕ Limpiar búsqueda
13,566
Total alertas
3081
Críticas
10213
Altas
8
Ransomware
1783
Esta semana
RSS
Crítica × Limpiar todo ×
O Crítico vulnerabilidad
17/06/2026
[CVE-2026-35270] Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten…
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly im…
nvdcriticovulnerabilidad CVSS 9.1 NVD
O Crítico vulnerabilidad
17/06/2026
[CVE-2026-35263] Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Support…
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebLogic Server. While the vulnerability is in WebLogic Server, attacks may significantly impact additional products (scope change…
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
16/06/2026
[CVE-2026-22313] The device has a webserver that exposes a REST API authenticated with a token on the management netw…
The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability an authenticated attacker can send arbitrary commands to the device that are executed with administrative permissions by the underlying operating system.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
16/06/2026
[CVE-2026-40750] Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store al…
Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Shell to a Web Server. This issue affects Kids Online Store: from n/a through 0.8.9.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-9691] Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, …
Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-49765] Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Eleme…
Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-49085] Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formida…
Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-49104] Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForm…
Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-49105] Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidabl…
Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-49109] Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elem…
Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-45439] Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions.
Unauthenticated SQL Injection in Realtyna Organic IDX plugin
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-50871] An OS command injection vulnerability in the media archiving and export pipeline component of kanish…
An OS command injection vulnerability in the media archiving and export pipeline component of kanishka-linux Reminiscence v0.3.0 allows attackers to execute arbitrary commands via supplying a crafted input.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-38812] RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affect…
RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affects the code generation module and may allow an authenticated attacker with administrative privileges to access sensitive database information.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-36537] ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code e…
ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote attacker can bypass authentication and gain full access to any existing user account on the platform w…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-8935] The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given …
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin access.
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
13/06/2026
[CVE-2026-12183] Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains a…
Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentication vulnerability (CWE-287) in the system configuration module. The /php/ajax-login.php endpoint returns userid=1 (administrator) in response to any HTTP POST request that supplies arbitrary credentials (e.g., action=dologin&login=&pwd=), and subsequent pr…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
12/06/2026
[CVE-2026-53609] ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4…
ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, `apos.util.set()` traverses dot-notation paths without sanitizing `__proto__`, allowing an authenticated editor to write arbitrary values to `Object.prototype` via the `$pullAll` patch operator. A confirmed gadget in `publicApiCheck()` causes this to bypass authorization on all piece-type RES…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
12/06/2026
[CVE-2026-53519] Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prio…
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefix, not a path-segment match, so the input /dashboard../data/config.yaml is accepted; strings.TrimPrefix…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
12/06/2026
[CVE-2026-46716] Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From…
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember user can create a scheduled cron task with Cover=CronCoverAll, Servers=[] and an arbitrary Command. At every tick of the scheduler, the dashboard pushes that command to every server in the global ServerShared map — including servers that belong to…
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
12/06/2026
[CVE-2026-44990] ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simp…
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can…
nvdcriticovulnerabilidad CVSS 9.3 NVD