Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,394
Total alertas
3047
Críticas
10075
Altas
8
Ransomware
1739
Esta semana
RSS
Crítica × 30 días × Limpiar todo ×
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-59550] Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions.
Unauthenticated SQL Injection in AWP Classifieds
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-59538] Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions.
Unauthenticated SQL Injection in GamiPress
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-59549] Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-59527] Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.
Unauthenticated SQL Injection in MapSVG
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-59533] Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions.
Unauthenticated SQL Injection in Relevanssi Light
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-65879] Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret …
Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-61511] vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB…
vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style …
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
A Crítico vulnerabilidad
27/07/2026
[CVE-2026-55971] Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache T…
Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
nvdcriticovulnerabilidad CVSS 9.8 NVD
A Crítico vulnerabilidad
27/07/2026
[CVE-2026-58023] Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift…
Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
nvdcriticovulnerabilidad CVSS 9.1 NVD
A Crítico vulnerabilidad
27/07/2026
[CVE-2026-58662] Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrif…
Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
nvdcriticovulnerabilidad CVSS 9.1 NVD
A Crítico vulnerabilidad
27/07/2026
[CVE-2026-48144] Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings…
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-64534] In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED be…
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally. However, if the command arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init() had returned false and percpu_ref_tryget_liv…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-64535] In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF wh…
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() — which p…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-13597] The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its …
The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the login code, and redeem it through an unauthenticated AJAX action to log in as that user, including an a…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-13714] The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate th…
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve rem…
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-14289] The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one…
The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a cryptographic key that is empty in the default, unconfigured state, allowing unauthenticated attackers to write an arbitrary file into a web-accessible directory and achieve remote code execution.
nvdcriticovulnerabilidad CVSS 9.0 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-12394] The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end reg…
The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-13332] The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unaut…
The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
26/07/2026
[CVE-2026-64530] In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_A…
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf_classify() can return TC_ACT_CONSUMED while the skb is held by the defragmentation engine (e.g. act_ct on out-of-order fragments). When that happens the skb is no longer owned by the caller and must not be touched again. tcf_qevent_handle() did not handle TC_AC…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
25/07/2026
[CVE-2026-66012] SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint…
SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check (model.CheckAuth) with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy actions across the entire workspace. When the Publish server is enabled in anonymous mode (Conf.Publis…
nvdcriticovulnerabilidad CVSS 10.0 NVD