Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,419
Total alertas
4761
Críticas
17027
Altas
8
Ransomware
1260
Esta semana
RSS
Crítica × Limpiar todo ×
M Crítico vulnerabilidad
20/08/2026
[CVE-2026-17040] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod…
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
20/08/2026
[CVE-2026-71485] Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies …
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in internal/proxy/http.go, the requestMetadata path in internal/proxy/grpc.go, and the Consume path in in…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
20/08/2026
[CVE-2026-67567] A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a ten…
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources (CRs), to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated ServiceAccount privileges without proper validation. This enables the tenant to deploy arbitrary reso…
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
20/08/2026
[CVE-2026-77148] A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the fi…
A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This impacts the function sub_44B50C of the file /cgi-bin/mbox-config?method=SET&section=ptest_channel of the component Web Management. The manipulation results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
20/08/2026
[CVE-2026-66785] A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect ne…
A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clusters (peer clusters) by publishing a specially crafted network endpoint. The system fails to properly validate the network subnets provided by the malicious cluster, enabling it to declare arbitrary network ranges. Consequently, all network traffic intended for…
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
20/08/2026
[CVE-2026-66788] A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vu…
A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespa…
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
20/08/2026
[CVE-2026-73256] Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated atta…
Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function in src/http.c tests hm.proto.len with an impossible greater-than-eight condition even though mg_http_parse() requires an eight-byte protocol stri…
nvdcriticovulnerabilidad CVSS 9.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
20/08/2026
[CVE-2026-73257] Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthentica…
Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use …
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
20/08/2026
[CVE-2026-77022] A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the functi…
A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component SSID Configuration. The manipulation of the argument ssid results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks…
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
20/08/2026
[CVE-2026-71428] The unstructured library provides open-source components for ingesting and pre-processing images and…
The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partition_html, and partition_md is fetched without host validation in unstructured/partition/auto.py, unstructured/partition/html/partition.py, and unstructured/partition/md.py. An…
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
20/08/2026
[CVE-2026-55642] dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth_middleware in c…
dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth_middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password_hash is None. A fresh deployment reaches that state when DBX_PASSWORD is unset and no stored password exists, while crates/dbx-web/src/main.rs binds the service to 0.0.0.0 on port 4224 by default. An unauthen…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
20/08/2026
[CVE-2026-18265] OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability. This vulnerability al…
OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OSNEXUS QuantaStor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of Kapacitor. The issue results from the lack of authentication prior to allowing access t…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
20/08/2026
[CVE-2026-16926] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary f…
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in input.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
20/08/2026
[CVE-2026-15706] Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry …
Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
20/08/2026
[CVE-2026-28164] Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Sit…
Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a through 2.3.7.
nvdcriticovulnerabilidad CVSS 9.6 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
20/08/2026
Carga arbitraria de archivos en IT Residence <= 3.2.1 (CVE-2026-74014)
Vulnerabilidad crítica (CVSS 9.9) en IT Residence versiones 3.2.1 y anteriores permite a suscriptores cargar archivos arbitrarios en servidores afectados. Esta falla expone sistemas de gestión inmobiliaria, comunes en empresas de administración de propiedades y desarrolladores en México y Latinoamérica, a ejecución remota de código y compromiso total de infraestructura.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
20/08/2026
Carga arbitraria de archivos en Smart Cleaning ≤ 4.8.6 afecta suscriptores
Se reporta una vulnerabilidad crítica (CVSS 9.9) en Smart Cleaning versiones 4.8.6 y anteriores que permite a usuarios suscritos cargar archivos arbitrarios en servidores. Esta falla compromete la integridad de sistemas y facilita inyección de malware en infraestructuras empresariales de LATAM. Afecta especialmente a empresas que utilizan esta plataforma para gestión de servicios de limpieza en múltiples sedes.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
20/08/2026
Carga arbitraria de archivos en Warehouse Cargo <= 2.6.9 (CVE-2026-74018)
Warehouse Cargo en versiones 2.6.9 y anteriores contiene una vulnerabilidad crítica (CVSS 9.9) que permite a usuarios suscritos cargar archivos arbitrarios en sistemas afectados. Esta falla expone servidores en México y Latinoamérica a compromiso total de integridad de datos y ejecución de código remoto en infraestructuras logísticas y de almacenamiento.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
20/08/2026
Escalada de Privilegios sin Autenticación en Abandoned Cart Pro para WooCommerce ≤ 10.4.0
Se identificó una vulnerabilidad crítica (CVSS 9.8) de escalada de privilegios sin autenticación en el plugin Abandoned Cart Pro para WooCommerce en versiones 10.4.0 y anteriores. Esta falla permite a atacantes remotos obtener acceso administrativo en tiendas WooCommerce sin credenciales válidas. Afecta especialmente a pequeñas y medianas empresas en LATAM que operan plataformas de e-commerce sin parchear regularmente sus plugins.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
20/08/2026
Inyección SQL sin autenticación en BookingPress Appointment Booking Pro <= 6.0.2
Se ha identificado una vulnerabilidad crítica de inyección SQL sin autenticación en BookingPress Appointment Booking Pro versiones 6.0.2 y anteriores (CVSS 9.3). Esta falla permite a atacantes remotos ejecutar comandos SQL arbitrarios contra bases de datos de sitios WordPress que utilizan este plugin, comprometiendo datos de clientes, citas y información sensible. En LATAM, donde muchos pequeños negocios y empresas utilizan este plugin para agendamiento de servicios (salones, consultorios, servicios profesionales), la exposición es crítica.
nvdcriticovulnerabilidad CVSS 9.3 NVD