Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 3 horas
22,419
Total alertas
4761
Críticas
17027
Altas
8
Ransomware
1253
Esta semana
RSS
alto × 30 días × Limpiar todo ×
M Alto vulnerabilidad
18/09/2026
[CVE-2026-10744] IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denia…
IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to an integer overflow in MQINQ request validation.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
18/09/2026
[CVE-2026-10751] IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code…
IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applications due to a deserialization filter bypass in exception handling.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
18/09/2026
[CVE-2025-61682] Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query dat…
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and prior to 7.0.0 insert the unsanitized value of a data attribute into the DOM as HTML, allowing for stored XSS through wikitext. Version 7.0.0 patches the issue.
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
18/09/2026
[CVE-2026-10027] IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a…
IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data on channels configured with compression enabled.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
18/09/2026
[CVE-2025-14753] IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An…
IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
18/09/2026
[CVE-2025-14754] IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with el…
IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
18/09/2026
[CVE-2026-93657] hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Reso…
hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.
nvdaltovulnerabilidad CVSS 7.5 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
18/09/2026
[CVE-2026-93658] uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before f…
uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.
nvdaltovulnerabilidad CVSS 7.0 NVD
M Alto vulnerabilidad
18/09/2026
[CVE-2026-93659] Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escapi…
Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts or exfiltrate data.
nvdaltovulnerabilidad CVSS 8.7 NVD
M Alto vulnerabilidad
18/09/2026
[CVE-2026-93576] Netty netty-codec-smtp — SMTP command-name field is not CRLF-validated (incomplete fix of CVE-2025-5…
Netty netty-codec-smtp — SMTP command-name field is not CRLF-validated (incomplete fix of CVE-2025-59419)
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
18/09/2026
[CVE-2026-93652] Integer overflow in µD3TN v0.15.0 TCPCLv3 handshake causes heap overflow, allowing remote attackers …
Integer overflow in µD3TN v0.15.0 TCPCLv3 handshake causes heap overflow, allowing remote attackers to reliably cause DoS
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
18/09/2026
[CVE-2026-93565] ### Summary `RtspMethods.valueOf()` silently strips trailing control bytes (any character with code…
### Summary `RtspMethods.valueOf()` silently strips trailing control bytes (any character with code point
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
18/09/2026
[CVE-2026-93567] HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :author…
HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
18/09/2026
[CVE-2026-93568] HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests
HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
18/09/2026
[CVE-2026-93569] HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target…
HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority
nvdaltovulnerabilidad CVSS 8.2 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
18/09/2026
[CVE-2026-93558] Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service
Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
18/09/2026
[CVE-2026-93564] HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881)
HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881)
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
18/09/2026
[CVE-2026-77929] ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users…
ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile() function in fileupload.class.php fails to update the file extension after MIME validation, allowing an attacker-controlled .php extension to persist …
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
18/09/2026
[CVE-2026-93604] vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embed…
vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM (require.builtin: ['crypto']). The builtin sanitizer (sanitizeCryptoModule in lib/builtin.js) replaces crypto.setEngine but leaves crypto.setFips callable, and the readonly wrapper used to expose the host module does not localize side effects…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
18/09/2026
[CVE-2026-93597] ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by…
ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services and cloud metadata endpoints.
nvdaltovulnerabilidad CVSS 7.7 NVD