Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

13,434

Total alertas

3054

Críticas

10108

Altas

8

Ransomware

1778

Esta semana

RSS

Crítica × cwe-288 × Limpiar todo ×

M Crítico vulnerabilidad

Autenticación rota en User Registration & Membership Pro <= 5.4.5 (CVE-2026-74001)

Se ha identificado una vulnerabilidad crítica de autenticación sin validación en User Registration & Membership Pro versión 5.4.5 y anteriores, permitiendo a atacantes acceder a funciones sensibles sin credenciales válidas. Afecta principalmente a sitios WordPress en México y LATAM que utilizan este plugin para gestión de usuarios. El CVSS de 9.8 indica riesgo severo para confidencialidad e integridad de datos de membresía.

M Crítico vulnerabilidad

[CVE-2026-73381] Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.

Unauthenticated Broken Authentication in Popup by Supsystic

M Crítico vulnerabilidad

[CVE-2026-75627] Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unaut…

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager accounts, and register managed systems, gaining control over SSH access to the managed fleet.

M Crítico vulnerabilidad

[CVE-2026-75045] In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker…

In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature

M Crítico vulnerabilidad

[CVE-2026-66465] Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.

Unauthenticated Broken Authentication in Cartify

M Crítico vulnerabilidad

[CVE-2026-66453] Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions.

Unauthenticated Broken Authentication in Salon booking system

M Crítico vulnerabilidad

[CVE-2026-24254] NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attack…

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Crítico vulnerabilidad

[CVE-2026-15014] The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for …

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the `billing_phone` parameter. This is due to the `processRegistration()` function using a phone-unbound `$_SESSION['sa_mobile_verified']` boolean flag as the sole gate before…

M Crítico vulnerabilidad

[CVE-2026-61884] The web management interface of Tycon Systems TPDIN-Monitor-WEB2 does not perform server-side vali…

The web management interface of Tycon Systems TPDIN-Monitor-WEB2 does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fields, an unauthenticated remote attacker can bypass the authentication check and establish a valid administrative session. This grants full access to device controls including power relay management, dev…

M Crítico vulnerabilidad

[CVE-2026-57807] Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Softwa…

Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO (OAuth Client) allows Password Recovery Exploitation. This issue affects OAuth Single Sign On - SSO (OAuth Client): from n/a through 38.5.8.

M Crítico vulnerabilidad

[CVE-2026-5268] An authentication bypass vulnerability exists in the default SFTP server component utilized across t…

An authentication bypass vulnerability exists in the default SFTP server component utilized across the Ciena products listed. This vulnerability allows a remote, unauthenticated attacker to bypass security controls and gain unauthorized access to the underlying filesystem. Successful exploitation could allow an attacker to read or modify system files.

M Crítico vulnerabilidad

[CVE-2026-58172] Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability tha…

Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability that allows denied clients to circumvent IP-based access restrictions by sending WebSocket upgrade requests. The WebSocket upgrade pipeline branch configured via MapWhen in OcelotPipelineExtensions.cs omits SecurityMiddleware, causing requests from blocked IP addresses to be proxied to downstream servi…

K Crítico vulnerabilidad

[CVE-2026-53576] Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authe…

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresses its resources by URL path segments that the caller chooses (/api/v1/{tenant}/flows/{namespace},…

T Crítico vulnerabilidad

[CVE-2026-48491] Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity…

Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity vulnerability in Traefik's domain-fronting protection (SNICheck) that allows an unauthenticated client to bypass mutual TLS enforced through wildcard router TLSOptions. When a router uses a wildcard host rule such as Host(*.example.com) with stricter TLS options (for example RequireAndVerifyClientC…

T Crítico vulnerabilidad

[CVE-2026-53622] Traefik is an HTTP reverse proxy and load balancer. Prior to 3.7.3, there is a critical vulnerabilit…

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.7.3, there is a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection that allows unauthenticated clients to bypass router-specific mTLS enforcement. When HTTP/3 is enabled on an entrypoint, the TLS handshake selects the applicable TLS configuration through an exact, case-sensitive lookup on the SNI value, which…

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

T Crítico vulnerabilidad

[CVE-2026-48020] Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a …

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulnerability in Traefik's StripPrefix middleware that allows an unauthenticated attacker to bypass route-level authentication and authorization. When a public router matches on a PathPrefix rule and applies the StripPrefix middleware, a request path containing .. or its percent-encode…

M Crítico vulnerabilidad

[CVE-2019-25763] WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability…

WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attackers to gain unauthorized access by exploiting the social media login form functionality. Attackers can submit a POST request to the admin-ajax.php endpoint with the uabb-lf-google-submit action, a valid administrator email address, and a valid nonce to obtain session cookies and a…

M Crítico vulnerabilidad

[CVE-2026-49767] Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.

Unauthenticated Broken Authentication in wpForo Forum

M Crítico vulnerabilidad

[CVE-2026-49764] Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions.

Unauthenticated Broken Authentication in RegistrationMagic

I Crítico vulnerabilidad

[CVE-2026-10523] An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R1…

An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access