Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 2 horas
22,419
Total alertas
4761
Críticas
17027
Altas
8
Ransomware
1255
Esta semana
RSS
Crítica × nvd × Limpiar todo ×
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-52889] Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hi…
Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Value to Craft's Twig rendering layer during front-end form rendering. An unauthenticated attacker can place Twig syntax in one of these request-controlled inputs when…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-47187] SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue …
SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local filesystem. The documented transform_symlinks mitigation does not contain relative targets because transform…
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-16816] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute…
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-16656] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to gain root privileges …
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to gain root privileges due to improper authentication.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-15065] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security r…
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate authority private keys in a publicly available update file.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-15068] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to exe…
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-16019] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Faydam Innovation Inc. FAYDAM Datalogger allows SQL Injection. This issue affects FAYDAM Datalogger: from 2.7.1 before 2.8.0.
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-73388] Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions.
Unauthenticated SQL Injection in Nikstore Core
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-73389] Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.
Unauthenticated PHP Object Injection in Kalles Addons
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-73390] Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.
Unauthenticated Privilege Escalation in Total Donations
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-73391] Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.
Unauthenticated SQL Injection in Total Donations
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-73347] Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions.
Unauthenticated Privilege Escalation in TrueBooker
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-73364] Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions.
Customer PHP Object Injection in Flexible Subscriptions
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-73183] Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions.
Unauthenticated SQL Injection in Maps Marker Pro
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-73185] Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.
Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.
nvdcriticovulnerabilidad CVSS 9.3 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-66613] Unauthenticated Remote Code Execution (RCE) in JetEngine <= 3.8.14 versions.
Unauthenticated Remote Code Execution (RCE) in JetEngine
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-18937] The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accep…
The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.
nvdcriticovulnerabilidad CVSS 9.0 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-18776] The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of i…
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-18031] The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before est…
The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-18051] The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it use…
The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name. On Apache, the same flaw overwrites the site's .htaccess files, which breaks the site and can stri…
nvdcriticovulnerabilidad CVSS 10.0 NVD