Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 12 horas
13,736
Total alertas
3106
Críticas
10358
Altas
8
Ransomware
1020
Esta semana
RSS
Crítica × Limpiar todo ×
M Crítico vulnerabilidad
23/07/2026
[CVE-2026-59526] Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.
Unauthenticated SQL Injection in MapSVG
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
23/07/2026
[CVE-2026-59540] Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions.
Unauthenticated Privilege Escalation in SMS Alert Order Notifications
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
23/07/2026
[CVE-2026-57784] Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 v…
Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
23/07/2026
[CVE-2026-27064] Editor Arbitrary File Upload in Mailster <= 4.1.17 versions.
Editor Arbitrary File Upload in Mailster
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
23/07/2026
[CVE-2026-64873] Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could a…
Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
23/07/2026
[CVE-2026-64874] Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN creden…
Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
23/07/2026
[CVE-2026-65431] Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives ha…
Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives have been broadly extracted without path validation, leading to unsafe file extractions.
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
23/07/2026
[CVE-2026-15015] The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypa…
The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to obtain an administrator-bound OAuth Bearer token via a self-registered client, granting full admini…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
23/07/2026
[CVE-2026-14282] The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Video…
The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the save_video_file() function hooked into WPForms' public wpforms_process_before_filter, which trusts the attacker-supplied multipart C…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
23/07/2026
[CVE-2026-15011] The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection v…
The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possible for unauthenticated attackers to invoke arbitrary parameterless PHP functions, which can be used to d…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
23/07/2026
[CVE-2026-16723] A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerabi…
A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
nvdcriticovulnerabilidad CVSS 9.0 NVD
O Crítico vulnerabilidad
22/07/2026
[CVE-2026-60369] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security…
nvdcriticovulnerabilidad CVSS 9.9 NVD
O Crítico vulnerabilidad
22/07/2026
[CVE-2026-60372] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result i…
nvdcriticovulnerabilidad CVSS 9.8 NVD
O Crítico vulnerabilidad
22/07/2026
[CVE-2026-60366] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Securit…
nvdcriticovulnerabilidad CVSS 10.0 NVD
O Crítico vulnerabilidad
22/07/2026
[CVE-2026-60367] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result i…
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
22/07/2026
[CVE-2026-64793] Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and …
Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to visitors who lacked the required access.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
22/07/2026
[CVE-2026-64796] Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free di…
Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured inc…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
22/07/2026
[CVE-2026-64798] Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL …
Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
22/07/2026
[CVE-2025-50329] An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate…
An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate privileges and execute arbitrary code via the powerarc.exe.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
22/07/2026
[CVE-2026-16624] Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to…
Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords, by triggering webhook delivery.
nvdcriticovulnerabilidad CVSS 9.6 NVD