Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

22,113

Total alertas

4677

Críticas

16848

Altas

8

Ransomware

1013

Esta semana

RSS

cwe-269 × Limpiar todo ×

M Alto vulnerabilidad

[CVE-2026-12251] The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities…

The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a site-defined role that carries administrator capabilities and gain administrative access, when such a…

M Alto vulnerabilidad

[CVE-2026-14980] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site req…

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.

M Alto vulnerabilidad

[CVE-2026-12687] The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor …

The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allowing unauthenticated users to register directly into a privileged group and be granted that group's configured role, up to Administrator when such a group exists, leading to privilege escalation.

G Alto vulnerabilidad

[CVE-2026-17969] Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote a…

Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

G Alto vulnerabilidad

[CVE-2026-17956] Inappropriate implementation in Scheduling in Google Chrome prior to 151.0.7922.72 allowed a remote …

Inappropriate implementation in Scheduling in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

G Alto vulnerabilidad

[CVE-2026-17950] Inappropriate implementation in Safebrowsing in Google Chrome on Mac prior to 151.0.7922.72 allowed …

Inappropriate implementation in Safebrowsing in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code via a malicious file. (Chromium security severity: Low)

G Alto vulnerabilidad

[CVE-2026-17952] Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who c…

Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Alto vulnerabilidad

[CVE-2026-17877] Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 151.0.7922.72 allowed …

Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via malicious network traffic. (Chromium security severity: Medium)

M Alto vulnerabilidad

[CVE-2026-17863] Inappropriate implementation in Browser in Google Chrome on Windows prior to 151.0.7922.72 allowed a…

Inappropriate implementation in Browser in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)

M Alto vulnerabilidad

[CVE-2026-17864] Inappropriate implementation in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a loc…

Inappropriate implementation in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)

M Alto vulnerabilidad

[CVE-2026-17868] Insufficient policy enforcement in USB in Google Chrome prior to 151.0.7922.72 allowed a remote atta…

Insufficient policy enforcement in USB in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

M Alto vulnerabilidad

[CVE-2026-17816] Insufficient policy enforcement in Speech in Google Chrome on Android prior to 151.0.7922.72 allowed…

Insufficient policy enforcement in Speech in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

M Alto vulnerabilidad

[CVE-2026-17751] Inappropriate implementation in AdFilter in Google Chrome prior to 151.0.7922.72 allowed a remote at…

Inappropriate implementation in AdFilter in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

M Alto vulnerabilidad

[CVE-2026-17744] Inappropriate implementation in File Input in Google Chrome on Linux prior to 151.0.7922.72 allowed …

Inappropriate implementation in File Input in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

M Alto vulnerabilidad

[CVE-2026-12144] The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all vers…

The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the `save_requests_meta()` function applying only `sanitize_text_field()` to the `user_role_set` POST parameter before passing it directly to `WP_User::add_role()`, with no allowlist validation against permitted wholesale roles and no capability check…

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Alto vulnerabilidad

[CVE-2026-18107] A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A mal…

A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint, allowing it to spoof the process credentials saved in the checkpoint image. On restore, the container process gains elevated capabilities and zeroed UIDs/GIDs. The …

M Alto vulnerabilidad

[CVE-2026-15992] The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all versions up…

The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 3.7.1. This is due to missing authorization checks and nonce verification in the `get_user()` function of the `Module_Password_Hint` class, which unconditionally calls `WP_User::set_role()` with the attacker-supplied `role` parameter on any account resolved via `$_POST['user_login'…

M Alto vulnerabilidad

[CVE-2026-14328] The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is …

The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the `wp_ajax_pos_get_option` AJAX handler, which verifies only a nonce that is localized to every logged-in admin-area user via `admin_enqueue_scripts` — without any capabilit…

M Crítico vulnerabilidad

[CVE-2026-14545] The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a u…

The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.

J Alto vulnerabilidad

[CVE-2026-66015] An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-p…

An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platform administrator access.

← Anterior 1 … 11 12 13 14 15 … 26 Siguiente →