Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,181
Total alertas
4701
Críticas
16892
Altas
8
Ransomware
1054
Esta semana
RSS
cwe-862 × Limpiar todo ×
M Alto vulnerabilidad
19/08/2026
[CVE-2026-62666] Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's cont…
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey(), generate2fa(), and disable2fa() omit the accessGrantsSuper() target check used by sibling user mutation endpoints. A non-super account with api.users.write can mint an API key bound to an access.api.super target through requireApi…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-62667] Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's cont…
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey() stores a declared scopes array, but ApiKeyAuthenticator::authenticate() does not read keyData[scopes] and returns the owning user's complete identity. AbstractApiController::requirePermission() consequently evaluates the full user…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-58565] Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A…
Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-58562] Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A…
Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-76223] ArcadeDB (com.arcadedb) versions 26.7.3 and earlier fail to enforce the UPDATE_SCHEMA permission che…
ArcadeDB (com.arcadedb) versions 26.7.3 and earlier fail to enforce the UPDATE_SCHEMA permission check when a DEFINE FUNCTION statement targets an already-existing function library. A user with only database access can add or overwrite SQL or Cypher functions in an existing library and persist the change, enabling tampering with admin-defined function logic. The issue is fixed in 26.8.1. (JavaScri…
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-73394] Unauthenticated Broken Access Control in Stitch Express <= 1.9.0 versions.
Unauthenticated Broken Access Control in Stitch Express
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-73385] Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.
Unauthenticated Broken Access Control in Outranking Plugin Options
nvdaltovulnerabilidad CVSS 7.5 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
18/08/2026
[CVE-2026-71307] Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/desti…
Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required admin_permission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting sensitive values. The sftp-destination plugin stored password and privateKeyPass values in plaintext, allow…
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-71308] Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit…
Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers that AssociatedCertificateSchema resolved with fetch_objects without a CertificatePermission check. Assigning those objects to Certificate.replaces invoked an append listener that disabled the victim certificate notifications and marked it as…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-67262] Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped …
Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to LUNs that the host is not authorized to access, bypassing per-initiator LUN access controls and leading to protection mechanism bypass.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-73994] Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.
Unauthenticated Broken Access Control in Charitable
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-73377] Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-73356] Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.
Unauthenticated Arbitrary Content Deletion in Breeze
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-69189] Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.use…
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history ide…
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-32549] Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.
Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.
nvdaltovulnerabilidad CVSS 7.5 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
18/08/2026
[CVE-2026-32472] Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.
Unauthenticated Broken Access Control in Online Contact Widget
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-28567] Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.
Unauthenticated Broken Access Control in WP Sort Order
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-28571] Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.
Unauthenticated Broken Access Control in FormyChat
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
18/08/2026
Vulnerabilidad de autorización en ArcadeDB versiones ≤26.7.3 permite eliminación no autorizada de funciones
ArcadeDB antes de la versión 26.8.1 contiene una falla de autorización que permite a cualquier usuario con acceso a la base de datos ejecutar DELETE FUNCTION sin validación de permisos. Un atacante puede eliminar funciones del servidor comprometiendo la integridad de aplicaciones que dependen de ArcadeDB en infraestructuras altas de LATAM. La vulnerabilidad (CVSS 7.1) afecta principalmente a bases de datos expuestas internamente o en entornos multi-tenant.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
18/08/2026
Vulnerabilidad alta en ArcadeDB: falla de autorización en plugin Gremlin (CVE-2026-75853)
El plugin Gremlin de ArcadeDB versiones ≤26.7.3 autentica conexiones pero no valida permisos de acceso a bases de datos, permitiendo que credenciales válidas accedan a cualquier base de datos sin autorización. Esto afecta directamente a empresas con infraestructuras de bases de datos distribuidas en LATAM que dependen del control granular de accesos. La vulnerabilidad tiene puntuación CVSS 8.8, indicando impacto alta en confidencialidad e integridad de datos.
nvdaltovulnerabilidad CVSS 8.8 NVD