Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 4 min
22,082
Total alertas
4667
Críticas
16827
Altas
8
Ransomware
1012
Esta semana
RSS
Crítica × cwe-89 × Limpiar todo ×
M Crítico vulnerabilidad
04/09/2026
[CVE-2026-18658] IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.…
IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
03/09/2026
[CVE-2026-82526] R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attacke…
R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via string formatting without identifier quoting or allowlist validation, enabling arbitrary DDL and DML execut…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
03/09/2026
[CVE-2026-84813] Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.
Unauthenticated SQL Injection in GeoDirectory
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
03/09/2026
[CVE-2026-84768] Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.
Unauthenticated SQL Injection in VikAppointments Services Booking Calendar
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
02/09/2026
[CVE-2026-81286] Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.
Unauthenticated SQL Injection in WCFM Marketplace
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
01/09/2026
[CVE-2026-18210] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Products's Store allows SQL Injection. This issue affects Products's Store: before 030631b2.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
01/09/2026
[CVE-2026-18765] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Teracity Software Technologies Inc. E-OSB allows SQL Injection. This issue affects E-OSB: before V02.26.07.08.01.
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-81763] Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.
Unauthenticated SQL Injection in Throws SPAM Away
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-81293] Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.
Unauthenticated SQL Injection in WP Data Access
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-81756] Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
28/08/2026
[CVE-2026-55634] Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026…
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import accepts a DataObject field name that is emitted without an identifier allowlist by lib/DataObject/ClassBuilder/FieldDefinitionPropertiesBuilder.php into generated PHP properties and …
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
27/08/2026
Inyección SQL sin autenticación en Beautiful Taxonomy Filters <= 2.4.6
Se ha identificado una vulnerabilidad crítica de inyección SQL sin autenticación en Beautiful Taxonomy Filters versión 2.4.6 y anteriores, con puntuación CVSS de 9.3. Esta falla permite a atacantes remotos ejecutar comandos SQL arbitrarios contra bases de datos de sitios WordPress afectados, comprometiendo la confidencialidad e integridad de datos. Empresas en LATAM que utilizan este plugin en sitios de comercio electrónico, portales administrativos o plataformas de contenido están expuestas a robo de información sensible y manipulación de registros.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
27/08/2026
[CVE-2026-78260] Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.
Unauthenticated SQL Injection in Epayco
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
27/08/2026
[CVE-2026-32479] Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions.
Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
25/08/2026
[CVE-2026-78568] The Total Donations plugin for WordPress is vulnerable to SQL Injection in all versions up to, and i…
The Total Donations plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive informa…
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
24/08/2026
[CVE-2026-32554] Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions.
Unauthenticated SQL Injection in WooBeWoo Product Filter Pro
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
24/08/2026
[CVE-2026-32555] Unauthenticated SQL Injection in Boost <= 2.0.4 versions.
Unauthenticated SQL Injection in Boost
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
24/08/2026
[CVE-2026-32551] Unauthenticated SQL Injection in Woo Essential <= 4.3.0 versions.
Unauthenticated SQL Injection in Woo Essential
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
21/08/2026
[CVE-2026-76904] GeoTools is an open source Java library that provides tools for geospatial data. Starting in version…
GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: `jsonArrayContains` function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater `jsonArrayContains(
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
20/08/2026
[CVE-2026-68782] Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Da…
Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 9.9 NVD