Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,162
Total alertas
4698
Críticas
16876
Altas
8
Ransomware
1037
Esta semana
RSS
cwe-269 × Limpiar todo ×
J Alto vulnerabilidad
27/07/2026
[CVE-2026-66015] An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-p…
An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platform administrator access.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-12394] The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end reg…
The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-13152] The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent …
The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be granted the administrator role when a correspondingly named field has been configured.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
24/07/2026
[CVE-2026-12497] The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict C…
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.18 does not consistently enforce the role restriction configured on its front-end registration role-selection field. The set of roles offered to the visitor and the set of roles the registration handler accepts are derived by two different parsers, and for some v…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
24/07/2026
[CVE-2026-12981] The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation wh…
The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
24/07/2026
[CVE-2026-12736] The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and incl…
The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) passing the request-supplied 'option' and 'data' parameters directly to update_option() without any option-name allowlist or value sanitization, while the permission_callback only verifies the…
nvdaltovulnerabilidad CVSS 8.0 NVD
M Alto vulnerabilidad
23/07/2026
[CVE-2026-38764] An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate priv…
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys
nvdaltovulnerabilidad CVSS 7.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
23/07/2026
[CVE-2026-15630] A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or mod…
A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Alto vulnerabilidad
23/07/2026
[CVE-2026-65897] Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::c…
Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership, and when accepted, the new account gains full super-admin API access without the inviter holding thos…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
23/07/2026
[CVE-2026-15017] The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions…
The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the `MDJM_Permissions::set_permissions()` and `MDJM_Employee_Manager::init()` functions, combined with the absence of server-side allow-list validation on the `employee_roles[]` and `new_role` POST par…
nvdaltovulnerabilidad CVSS 8.8 NVD
O Crítico vulnerabilidad
22/07/2026
[CVE-2026-60369] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security…
nvdcriticovulnerabilidad CVSS 9.9 NVD
O Alto vulnerabilidad
22/07/2026
[CVE-2026-60371] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Platform Security for Java executes to …
nvdaltovulnerabilidad CVSS 8.0 NVD
O Crítico vulnerabilidad
22/07/2026
[CVE-2026-60372] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result i…
nvdcriticovulnerabilidad CVSS 9.8 NVD
O Alto vulnerabilidad
22/07/2026
[CVE-2026-60373] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in…
nvdaltovulnerabilidad CVSS 8.8 NVD
O Alto vulnerabilidad
22/07/2026
[CVE-2026-60439] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in…
nvdaltovulnerabilidad CVSS 8.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
O Alto vulnerabilidad
22/07/2026
[CVE-2026-60455] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in…
nvdaltovulnerabilidad CVSS 8.8 NVD
O Alto vulnerabilidad
22/07/2026
[CVE-2026-61246] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
22/07/2026
[CVE-2026-38765] An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate priv…
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
22/07/2026
[CVE-2026-38766] An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate priv…
An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the sub_186f4 function
nvdaltovulnerabilidad CVSS 7.8 NVD
O Crítico vulnerabilidad
22/07/2026
[CVE-2026-60366] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Securit…
nvdcriticovulnerabilidad CVSS 10.0 NVD