Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "X" — 4166 resultados ✕ Limpiar búsqueda
22,417
Total alertas
4761
Críticas
17025
Altas
8
Ransomware
1275
Esta semana
RSS
30 días × Limpiar todo ×
M Alto vulnerabilidad
16/09/2026
[CVE-2026-27557] An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view…
An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
16/09/2026
[CVE-2026-27558] A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/att…
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint using operator credentials allowing execution of commands with root privileges on the device.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
16/09/2026
[CVE-2026-27559] A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/da…
A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
16/09/2026
[CVE-2026-27560] A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/d…
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
16/09/2026
[CVE-2026-27547] A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/aja…
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
16/09/2026
[CVE-2026-27548] A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/aja…
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user or operator credentials allowing execution of commands with root privileges on the device.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
16/09/2026
[CVE-2026-27549] A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/att…
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentials allowing execution of commands with root privileges on the device.
nvdaltovulnerabilidad CVSS 8.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
16/09/2026
[CVE-2026-27550] A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_P…
A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials allowing execution of commands with root privileges on the device.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
16/09/2026
[CVE-2026-27551] A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/aja…
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
16/09/2026
[CVE-2026-27552] A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devic…
A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Crítico vulnerabilidad
16/09/2026
[CVE-2026-27546] An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function…
An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
16/09/2026
[CVE-2026-73447] A privileged attacker can exploit certain operation to execute arbitrary commands with root privileg…
A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Alto vulnerabilidad
16/09/2026
[CVE-2026-79708] GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 bef…
GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their group and access protected CI/CD variables restricted to higher-privileged roles, due to insufficient scope…
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
16/09/2026
[CVE-2026-1168] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.…
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
16/09/2026
[CVE-2025-14871] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.…
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.
nvdaltovulnerabilidad CVSS 7.5 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
? Crítico alerta
16/09/2026
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA emite alerta de seguridad: CISA Adds Two Known Exploited Vulnerabilities to Catalog. CVEs relacionados: CVE-2026-76460, CVE-2026-87886.
cisaus-certalerta CISA KEV
? Crítico alerta
16/09/2026
CISA Adds One Known Exploited Vulnerability to Catalog
CISA emite alerta de seguridad: CISA Adds One Known Exploited Vulnerability to Catalog. CVEs relacionados: CVE-2026-58704.
cisaus-certalerta CISA KEV
M Alto vulnerabilidad
16/09/2026
[CVE-2026-18595] The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJ…
The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all versions up to, and including, 3.8.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Crítico vulnerabilidad
16/09/2026
[CVE-2026-12793] The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Esc…
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for un…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
16/09/2026
[CVE-2026-86108] Insufficient validation of inputs supplied through affected VeloCloud Edge management and configurat…
Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated privileges on the affected VeloCloud Edge.
nvdaltovulnerabilidad CVSS 8.0 NVD