Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Multiple Vendors" — 3587 resultados ✕ Limpiar búsqueda
22,395
Total alertas
4758
Críticas
17006
Altas
8
Ransomware
1254
Esta semana
RSS
Crítica × Limpiar todo ×
M Crítico vulnerabilidad
01/09/2026
[CVE-2026-75865] The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode pl…
The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saas_upload_logo() function combined with an authorization bypass on the WPLP connector REST endpoints in all versions up to, and including, 4.4.1. This makes it possible for unauthenticated attacker…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-82971] A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown par…
A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains: "QVidium has now closed its doors and no longer wi…
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-83524] A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optim…
A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 20260704. This impacts the function exec of the file /xgatev1/system/datetime.php of the component System Clock. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted ear…
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-82954] A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikCo…
A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath of the file packages/server/src/utils/traefik/application.ts of the component Settings. The manipulation of the argument path results in path traversal. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but…
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-82226] Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.
Unauthenticated PHP Object Injection in Tickera
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-81780] Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.
Unauthenticated Arbitrary File Upload in Hash Form
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-81763] Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.
Unauthenticated SQL Injection in Throws SPAM Away
nvdcriticovulnerabilidad CVSS 9.3 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-81779] Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows …
Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted. This issue affects Newspapers X: from 1.0.46 through 1.0.48.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-81293] Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.
Unauthenticated SQL Injection in WP Data Access
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-81756] Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-53552] Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile…
Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the project belongs to the caller's namespace. The corresponding model.ProjectFile.GetData and model.Project.Ge…
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-79748] MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/AP…
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub create/update MCP server configurations and then immediately spawn the configured stdio process via child_process.spawn. Authentication is requi…
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-51725] Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748_B20211015 allows…
Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the device clock via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-51730] Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows…
Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-51720] Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 a…
Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove firewall filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
nvdcriticovulnerabilidad CVSS 9.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-76133] The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related oper…
The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacker can manipulate or predict the authentication exchange, the weak construction may reduce the assurance provided by the authentication mechanism and facilitate unauthorized access.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-73819] The affected Ebyte product's vendor configuration utility permits access to administrative functi…
The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials, potentially preventing legitimate administrators from managing the device.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-82970] Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for…
Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files. This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 4.4.1.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-59111] Improper neutralization of special elements used in an OS command ('OS command injection') vulnerabi…
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura (DIA) eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme (czeeopauth://) for parameterized application execution. Prior to version 3.6.0, incoming URL parameters were passed to the compiled AppleScript wrapper using concatenatio…
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-51679] Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows …
Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
nvdcriticovulnerabilidad CVSS 9.1 NVD