Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,434
Total alertas
3054
Críticas
10108
Altas
8
Ransomware
1778
Esta semana
RSS
nvd × Este mes × Limpiar todo ×
M Crítico vulnerabilidad
03/08/2026
[CVE-2026-69083] SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetConten…
SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
03/08/2026
[CVE-2026-69084] SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-su…
SiYuan versions
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
03/08/2026
[CVE-2026-69085] SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint…
SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement exec…
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Alto vulnerabilidad
03/08/2026
[CVE-2026-69086] SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-…
SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints, allowing attackers to construct traversal paths that escape the storage directory. Authenticated users with RoleReader permissions or anonymous clients when publish authentication is disabled can read JSON files outside the attribute-view directory to disclose cross-scope databa…
nvdaltovulnerabilidad CVSS 7.7 NVD
M Crítico vulnerabilidad
03/08/2026
[CVE-2026-64827] Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a…
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches 'login_admin.php'. Attackers can append '/login_admin.php' to the path of any target PHP s…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
03/08/2026
[CVE-2026-67608] Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a…
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
03/08/2026
[CVE-2026-68584] SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where c…
SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retrieve full content of password-protected documents by obtaining internal block IDs from reader-accessible …
nvdaltovulnerabilidad CVSS 8.6 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
03/08/2026
[CVE-2026-18642] Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Ins…
Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
03/08/2026
[CVE-2026-18600] A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.s…
A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was …
nvdaltovulnerabilidad CVSS 8.8 NVD
M Crítico vulnerabilidad
03/08/2026
[CVE-2026-18601] A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.ch…
A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about …
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
03/08/2026
[CVE-2026-18092] Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping…
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtree. new_from_xml reads the NameID, attribute values, SessionIndex, audience and other identity fields with document-wide XPath, such as //saml:Assertion/saml:AttributeStatement/saml:Attribute and //sa…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Crítico vulnerabilidad
03/08/2026
[CVE-2026-18108] Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_asser…
Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature. _verify_encrypted_assertion decrypts the EncryptedAssertion and returns it as verified when it carries no signature, via "return $xml unless $xpath->exists('dsig:Signature', $assert);". The signature check and the trus…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
03/08/2026
[CVE-2026-18089] Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses aga…
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured. verify_xml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig check succeeds, and that check uses the X.509 certificate taken from the response's own dsig:KeyInfo/dsi…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
03/08/2026
[CVE-2026-2346] Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App a…
Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile App: through 12.05.2026.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
03/08/2026
[CVE-2026-18598] A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function …
A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_log of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC plugin. The manipulation of the argument module results in command injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this d…
nvdaltovulnerabilidad CVSS 8.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
03/08/2026
[CVE-2026-18599] A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread…
A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC Plugin. This manipulation of the argument record_size causes command injection. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of …
nvdaltovulnerabilidad CVSS 8.0 NVD
M Alto vulnerabilidad
03/08/2026
Vulnerabilidad alta de validación de entrada en módems permite denegación de servicio remota
Se ha identificado una falla de validación de entrada impropia en módems que permite a atacantes remotos provocar denegación de servicio sin necesidad de privilegios adicionales. Esta vulnerabilidad (CVSS 7.5) afecta directamente la disponibilidad de conectividad en infraestructuras altas, centros de datos y redes corporativas en México y Latinoamérica que dependen de estos dispositivos.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
03/08/2026
Vulnerabilidad de validación de entrada en módems permite denegación de servicio remota (CVE-2026-21554)
Se ha identificado una falla de validación de entrada en módems de múltiples fabricantes que permite ataques de denegación de servicio remota sin requieren privilegios adicionales. Esta vulnerabilidad afecta infraestructura alta de conectividad en empresas y proveedores de servicios en LATAM. Con puntuación CVSS 7.5, representa un riesgo elevado para la continuidad operativa de sistemas que dependen de estos dispositivos.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
03/08/2026
Vulnerabilidad de validación de entrada en módems permite denegación de servicio remota (CVE-2026-21555)
Se ha identificado una vulnerabilidad alta (CVSS 7.5) en módems de múltiples fabricantes que permite a atacantes remotos provocar denegación de servicio sin requerir privilegios adicionales. La falla radica en una impropia validación de entrada que afecta directamente a infraestructuras de conectividad en empresas, ISPs y operadores de telecomunicaciones en México y Latinoamérica. Este tipo de vulnerabilidad impacta servicios altas de comunicación corporativa.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
03/08/2026
Vulnerabilidad de validación en módems NR permite denegación de servicio remota (CVE-2026-21548)
Se ha identificado una falla de validación de entrada impropia en módems 5G NR que permite a atacantes remotos provocar denegación de servicio. La vulnerabilidad requiere privilegios de ejecución del sistema y afecta principalmente a infraestructuras de telecomunicaciones y dispositivos IoT conectados en redes móviles de LATAM. Con CVSS 7.5, representa un riesgo significativo para operadores y empresas dependientes de conectividad 5G.
nvdaltovulnerabilidad CVSS 7.5 NVD