Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Multiple Vendors" — 5598 resultados ✕ Limpiar búsqueda
22,841
Total alertas
4833
Críticas
17354
Altas
8
Ransomware
1360
Esta semana
RSS
30 días × Limpiar todo ×
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-85885] Improper neutralization of special elements used in a command ('command injection') in M365 Copilot …
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-85889] Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to …
Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-85917] Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate pr…
Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-87701] Improper neutralization of special elements in output used by a downstream component ('injection') i…
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-87886] Local privilege escalation due to insecure file permissions. The following products are affected: Ac…
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-83944] Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges ov…
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-78501] Improper neutralization of special elements used in a command ('command injection') in Microsoft 365…
Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.
nvdaltovulnerabilidad CVSS 7.4 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-77903] Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate …
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 9.0 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-70200] Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps a…
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-70009] Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows a…
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-69865] Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthori…
Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-69399] Azure Arc Elevation of Privilege Vulnerability
Azure Arc Elevation of Privilege Vulnerability
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-68791] Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose inform…
Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network.
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-93426] SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the …
SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals, executing arbitrary ClickHouse SQL to read system tables and exfiltrate data.
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-54671] WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an…
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in web/controle/InternoControle.php, including listarUm, alterar, and excluir, accept user-controlled id or…
nvdaltovulnerabilidad CVSS 8.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-54734] Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters in…
Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who can supply bid-request parameters can cause the server to send HTTP requests to unintended destinations, potentially reaching internal network …
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-54767] WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controlle…
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletar_socios.php exposes an unauthenticated GET endpoint whose chave parameter is checked only against a hardcoded chave_correta value embedded in the public source repository. A remote attacker who obtains that value can reach the endpoint's TRUNCATE TABLE operations for the endereco, pessoafis…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-54646] CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php …
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated administrator can terminate the quoted identifier with a closing backtick and introduce attacker-controlled…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
17/09/2026
[CVE-2026-54647] CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php dir…
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_expire POST parameter into a raw UPDATE statement for CubeCart_downloads without numeric validation. An authenticated administrator can supply a comma-delimited value that changes the SET clause because HTML sanitization does not neutralize SQ…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-54670] WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatc…
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controlled nomeClasse and metodo values without a complete controller and method allowlist, exempts sensitive ContribuicaoLogController operations from authentication, and constructs a controller include path without canonical dire…
nvdcriticovulnerabilidad CVSS 9.1 NVD