Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

22,093

Total alertas

4671

Críticas

16834

Altas

8

Ransomware

1017

Esta semana

RSS

Crítica × cwe-94 × Limpiar todo ×

M Crítico vulnerabilidad

Vulnerabilidad crítica en plugin ComboBlocks para WordPress permite inyección de hooks sin autenticación

El plugin 'The Post Grid and Gutenberg Blocks – ComboBlocks' en versiones 2.2.32 a 2.3.1 es vulnerable a inyección de hooks no autenticada, permitiendo a atacantes ejecutar acciones maliciosas en WordPress sin credenciales. La vulnerabilidad afecta miles de sitios web en México y LATAM que utilizan este plugin para construcción de contenido con Gutenberg, exponiendo datos y funcionalidades críticas del sitio.

M Crítico vulnerabilidad

[CVE-2026-83627] The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulner…

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The page-cache debug log is written to wp-content/wphb-logs/page-caching-log.php, a directly web-accessible PHP file that is supposed to be protected by a leadi…

M Crítico vulnerabilidad

[CVE-2026-31020] In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to d…

In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. An unauthenticated attacker can inject malicious template expressions, leading to a server-side template injection (SSTI) vulner…

M Crítico vulnerabilidad

[CVE-2026-58400] GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.…

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling Java extension functions (`ALLOW_EXTERNAL_FUNCTIONS`). Any stylesheet loaded by GeoNetwork can therefore invoke `java.lang.Runtime.exec()` or …

M Crítico vulnerabilidad

Vulnerabilidad crítica en Submariner: inyección de configuración en modo cert-auth

Se identificó una falla en Submariner que permite inyección de configuración arbitraria en modo autenticación por certificados. Un cluster malicioso puede explotar esta vulnerabilidad publicando un CableName con saltos de línea y directivas de ipsec.conf sin validación previa, comprometiendo la seguridad de redes híbridas y multi-cluster. El impacto afecta directamente a empresas en LATAM con infraestructuras Kubernetes distribuidas en cloud público y privado.

M Crítico vulnerabilidad

[CVE-2026-77009] The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console,…

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server.

M Crítico vulnerabilidad

[CVE-2026-18808] Improper Control of Generation of Code ('Code Injection') vulnerability in Klemsan Electrical Electr…

Improper Control of Generation of Code ('Code Injection') vulnerability in Klemsan Electrical Electronics Inc. KIO (Klemsan Internet Objects) allows Code Injection. This issue affects KIO (Klemsan Internet Objects): before v1.9.

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Crítico vulnerabilidad

[CVE-2026-19286] IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to…

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.

M Crítico vulnerabilidad

[CVE-2026-55565] Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getV…

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through SimpleCompiler.cook instead of applying ValueExpression.escapeJavaString. The pattern can originate from POST /…

M Crítico vulnerabilidad

[CVE-2026-55634] Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026…

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import accepts a DataObject field name that is emitted without an identifier allowlist by lib/DataObject/ClassBuilder/FieldDefinitionPropertiesBuilder.php into generated PHP properties and …

M Crítico vulnerabilidad

[CVE-2026-55559] Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from PO…

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The rendered configuration is parsed by YamcsServer.createInstance and loaded by YamcsServerInstance, allowing…

M Crítico vulnerabilidad

[CVE-2026-55511] Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPri…

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCode_InputDefVars and Expression.sanitizeName. A sum aggregate reaches yamcs-core/src/main/java/org/yamcs/yarch/streamsql/CompilableAggregateExpression.java and y…

M Crítico vulnerabilidad

Vulnerabilidad crítica de ejecución remota de código en Budibase anterior a v3.41.3

Budibase versiones anteriores a 3.41.3 contienen una vulnerabilidad de ejecución remota de código (RCE) en el manejo de plugins que permite a usuarios administradores autenticados ejecutar código arbitrario mediante la carga de un tarball malicioso. El servidor ejecuta eval() en archivos JavaScript de plugins sin aislamiento en el proceso Node.js principal, habilitando la exfiltración de variables de entorno y credenciales con privilegios root. Empresas en LATAM que utilicen Budibase en entornos de producción o desarrollo enfrentan riesgo crítico de compromiso total del servidor.

M Crítico vulnerabilidad

[CVE-2026-81096] ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that req…

ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, in python_executor_tool.py, inspected the submitted source for a denied list of attribute names and calls but left the attribute-lookup builtins available and did not stop a dunder attribute reached through a string lookup o…

M Crítico vulnerabilidad

[CVE-2026-55546] QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() i…

QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-controlled expression and claimed_result strings directly to SymPy's parse_expr() after only normalizing caret syntax to Python exponent syntax, without restricting global_dict, removing Python built-ins, or validating the expression AST. Because…

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Crítico vulnerabilidad

[CVE-2026-49845] SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on …

SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics updates, truncation targets, and file-metadata cache operations) via crafted partition names in metastore RPC requests when direct SQL is enabled…

M Crítico vulnerabilidad

[CVE-2026-62674] Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prio…

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /sessions/{session_id}/agent checks LEVEL_EDIT permission for a session but does not reject a bound shared or template agent whose agent.session_id is None. An authenticated user with edit access to a session can replace that shared agent bundle through omnigent/server/routes/session…

M Crítico vulnerabilidad

[CVE-2026-77806] SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited i…

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.

M Crítico vulnerabilidad

Ejecución remota de código en SPIP anterior a 4.4.20 (CVE-2026-77647)

SPIP versiones anteriores a 4.4.20 contiene una vulnerabilidad crítica (CVSS 9.8) que permite a atacantes no autenticados ejecutar código arbitrario de forma remota, explotada activamente desde agosto de 2026. La falla radica en la identificación incorrecta de bloques PHP y el manejo deficiente de caracteres especiales por var_export. Afecta directamente a instituciones, medios digitales y PyMEs que usan SPIP como gestor de contenidos en la región.

M Crítico vulnerabilidad

Ejecución remota de código crítica en Query Wrangler hasta versión 1.5.57 (CVE-2026-73992)

Se ha identificado una vulnerabilidad crítica de ejecución remota de código (RCE) en Query Wrangler versiones 1.5.57 e inferiores, con puntuación CVSS de 9.9. Los atacantes pueden ejecutar código arbitrario en sistemas que usen versiones vulnerables, comprometiendo bases de datos y aplicaciones dependientes. Esta vulnerabilidad afecta directamente a infraestructuras de procesamiento de consultas en empresas de telecomunicaciones, finanzas y servicios en la región.

← Anterior 1 2 3 4 5 6 … 10 Siguiente →