Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,434
Total alertas
3054
Críticas
10108
Altas
8
Ransomware
1778
Esta semana
RSS
Crítica × cwe-200 × Limpiar todo ×
M Crítico vulnerabilidad
Hace 5 días
[CVE-2026-62988] Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Cu…
Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and lib/Froxlor/Api/Commands/Ftps.php retrieve full database rows and return them without removing password and data_2fa fields. An aut…
nvdcriticovulnerabilidad CVSS 9.0 NVD
M Crítico vulnerabilidad
Hace 6 días
[CVE-2026-71424] Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers …
Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.set_tokens and OnyxTokenStorage.set_client_info in backend/onyx/server/features/mcp/api.py copy per-user tokens into a shared admin MCPConnectionConfig row and _db_mcp_se…
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
Hace 6 días
[CVE-2026-64859] New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management sys…
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token because User model objects are serialized after queries use Omit("password"), allowing an authenticated administrator to obtain the root user's bearer token and acces…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
13/08/2026
[CVE-2026-59503] CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Per…
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
06/08/2026
[CVE-2026-54489] Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a…
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This vulnerability is considered critical as it allows an unauthenticated attacker to obtain active session crede…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
31/07/2026
[CVE-2026-52855] Wings is the server control plane for Pterodactyl, a free, open-source game server management panel.…
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3.
nvdcriticovulnerabilidad CVSS 9.9 NVD
A Crítico vulnerabilidad
27/07/2026
[CVE-2026-64733] This issue was addressed with improved data protection. This issue is fixed in iOS 26.6 and iPadOS 2…
This issue was addressed with improved data protection. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to fingerprint the user.
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
A Crítico vulnerabilidad
27/07/2026
[CVE-2026-43730] A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.6 and …
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to fingerprint the user.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
23/07/2026
[CVE-2026-64874] Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN creden…
Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs.
nvdcriticovulnerabilidad CVSS 9.8 NVD
O Crítico vulnerabilidad
21/07/2026
[CVE-2026-61233] Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (c…
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: Integration). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Brazil. Successful attacks of this vulnerability can result in takeover of Pe…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
21/07/2026
[CVE-2026-61175] Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: I…
Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product Lifecycle Analytics. While the vulnerability is in Oracle Product Lifecycle Analytics, attacks may signi…
nvdcriticovulnerabilidad CVSS 9.3 NVD
O Crítico vulnerabilidad
21/07/2026
[CVE-2026-60551] Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCente…
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sit…
nvdcriticovulnerabilidad CVSS 9.8 NVD
O Crítico vulnerabilidad
21/07/2026
[CVE-2026-60552] Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCente…
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact a…
nvdcriticovulnerabilidad CVSS 9.9 NVD
O Crítico vulnerabilidad
21/07/2026
[CVE-2026-60555] Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCente…
Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sit…
nvdcriticovulnerabilidad CVSS 9.8 NVD
O Crítico vulnerabilidad
21/07/2026
[CVE-2026-60264] Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Suppor…
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Ba…
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
21/07/2026
[CVE-2026-16387] Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firef…
Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
20/07/2026
[CVE-2026-44231] RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6…
RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged (non-administrative) user can obtain authentication credentials belonging to other users — including users with administrative privileges — and use those credenti…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
20/07/2026
[CVE-2026-51027] An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2…
An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
14/07/2026
[CVE-2026-52101] An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensit…
An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadRemote function in upload.go
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
10/07/2026
[CVE-2026-55500] 9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows f…
9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. This issue is fixed in version 0.4.80.
nvdcriticovulnerabilidad CVSS 9.9 NVD