Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,599
Total alertas
3086
Críticas
10241
Altas
8
Ransomware
1807
Esta semana
RSS
Crítica × cwe-284 × Limpiar todo ×
S Crítico vulnerabilidad
21/07/2026
[CVE-2026-28321] SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary fi…
SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations.
nvdcriticovulnerabilidad CVSS 9.1 NVD
S Crítico vulnerabilidad
21/07/2026
[CVE-2026-28304] SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can all…
SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments.
nvdcriticovulnerabilidad CVSS 9.1 NVD
S Crítico vulnerabilidad
21/07/2026
[CVE-2026-28306] SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administr…
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator. The impact is lower in Windows deployments.
nvdcriticovulnerabilidad CVSS 9.1 NVD
S Crítico vulnerabilidad
21/07/2026
[CVE-2026-28307] SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user grou…
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is lower in Windows deployments.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
21/07/2026
[CVE-2025-66390] In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Ba…
In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Basic Authentication) is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI level. In other words, disabling signup in the UI does not disable the underlying API endpoint (which st…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
21/07/2026
[CVE-2026-16407] Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153…
Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
21/07/2026
[CVE-2026-16387] Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firef…
Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
20/07/2026
[CVE-2026-62414] Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla ext…
Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla extension Page Builder CK does not properly apply access control to frontend page list views.
nvdcriticovulnerabilidad CVSS 9.1 NVD
A Crítico vulnerabilidad
16/07/2026
[CVE-2026-54526] Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on…
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level fields of WorkflowSpec via reflection, and WorkflowSpec.ArtifactGC is allow-listed wholesale; the stru…
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
15/07/2026
[CVE-2026-14960] Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\…
Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers including `TDE_IOCTL_INDEXIO_READ` and `TDE_IOCTL_INDEXIO_WRITE` permit unprivileged user-mode callers to perform arbitrary hardware I/O port reads and writes without authorization checks. A local attacker can abuse this functionality to manipulate hardware re…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
13/07/2026
[CVE-2026-51538] EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability i…
EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server processes critical encapsulation commands, it verifies whether the provided session_handle exists in the global session list, but it fails to verify whether that handle belongs to the specific TCP connection issuing the request. Because there…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
10/07/2026
[CVE-2026-20744] The charging station websocket endpoint accepts connections without proper authentication, which co…
The charging station websocket endpoint accepts connections without proper authentication, which could lead to privilege escalation.
nvdcriticovulnerabilidad CVSS 9.8 NVD
A Crítico vulnerabilidad
06/07/2026
[CVE-2026-48204] Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gr…
Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operation parameter is not set - which is the default. The control-header constants (GridFsConstants.GRIDFS_OPERATION, GRIDFS_OBJECT_ID, GRIDFS_MET…
nvdcriticovulnerabilidad CVSS 9.8 NVD
A Crítico vulnerabilidad
06/07/2026
[CVE-2026-24014] Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trig…
Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name to write files outside the intended Trigger installation directory. This could allow arbitrary file writ…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
03/07/2026
[CVE-2026-58422] Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
03/07/2026
[CVE-2026-26247] Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during a…
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
03/07/2026
[CVE-2026-26292] Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror op…
Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
03/07/2026
[CVE-2026-20706] Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope c…
Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoint.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
03/07/2026
[CVE-2026-20896] Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by defaul…
Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.
nvdcriticovulnerabilidad CVSS 9.8 NVD
U Crítico vulnerabilidad
02/07/2026
[CVE-2026-55116] A malicious actor with access to the network and under certain network configurations could exploit …
A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices.
nvdcriticovulnerabilidad CVSS 9.0 NVD