Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,434
Total alertas
3054
Críticas
10108
Altas
8
Ransomware
1778
Esta semana
RSS
cwe-862 × 30 días × Limpiar todo ×
M Alto vulnerabilidad
28/07/2026
[CVE-2026-54719] goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, th…
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomple…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-16184] IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication…
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request.
nvdaltovulnerabilidad CVSS 7.0 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-49258] Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and belo…
Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*) does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web read/mutation surface. Any authenticated non-admin operator (for example, one created via self-registration …
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-15025] The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPre…
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automator_google_contacts_fetch_labels, automator_mautic_segment_fetch, automator_mautic_tags_fetch, and automator_mautic_render_contact_fields AJAX actions due to a missing capability check and missing nonce v…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-14168] A low privileged remote attacker can gain administrator privileges due to missing authorization at t…
A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system access.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
28/07/2026
[CVE-2026-14924] The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability,…
The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existing posts and pages.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-66473] Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions.
Unauthenticated Broken Access Control in Xendit Payment
nvdaltovulnerabilidad CVSS 7.5 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
A Crítico vulnerabilidad
27/07/2026
[CVE-2026-64746] An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.6 and i…
An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. An app may be able to add contacts without user authorization.
nvdcriticovulnerabilidad CVSS 9.8 NVD
J Alto vulnerabilidad
27/07/2026
[CVE-2026-65922] An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with li…
An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is not affected.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-59535] Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions.
Unauthenticated Broken Access Control in Thrive Product Manager
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-59536] Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions.
Unauthenticated Broken Access Control in CoCart – Headless ecommerce
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-59529] Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions.
Unauthenticated Sensitive Data Exposure in Ebook Store
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-59530] Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions.
Unauthenticated Broken Access Control in Stripe For WooCommerce
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-59534] Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions.
Unauthenticated Broken Access Control in Post My CF7 Form
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-59690] A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Objec…
A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise.
nvdaltovulnerabilidad CVSS 8.0 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
25/07/2026
[CVE-2026-66012] SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint…
SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check (model.CheckAuth) with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy actions across the entire workspace. When the Publish server is enabled in anonymous mode (Conf.Publis…
nvdcriticovulnerabilidad CVSS 10.0 NVD