Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 1 min
22,082
Total alertas
4667
Críticas
16827
Altas
8
Ransomware
1012
Esta semana
RSS
cwe-502 × Limpiar todo ×
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-104747] Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.
Unauthenticated PHP Object Injection in Haaken
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-82988] There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unkno…
There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-97257] Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-pla…
Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-93617] Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-ca…
Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-103348] Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate…
Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-100511] Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-goog…
Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-100506] Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allo…
Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from n/a through 12.1.
nvdaltovulnerabilidad CVSS 7.2 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
Hace 3 días
[CVE-2026-97283] Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager adva…
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-103349] Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce wo…
Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
Hace 4 días
[CVE-2026-104905] FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::…
FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. Attackers can submit a serialized XLSXWriter object as the field value to invoke its __destruct() method, deleting arbitrary attacker-specifie…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Crítico vulnerabilidad
01/10/2026
[CVE-2026-55083] DHIS2 is a flexible information system for data capture, management, validation, analytics and visua…
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution (RCE) via unsafe Java deserialization. This issue has been patched in versions 2.42.5.1, 2.43.0.1, and 2.44.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Alto vulnerabilidad
01/10/2026
[CVE-2026-12544] A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/sett…
A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side Template Injection (SSTI) and insecure deserialization. This vulnerability can lead to remote code exec…
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
01/10/2026
[CVE-2026-97284] Contributor PHP Object Injection in Icegram <= 3.1.31 versions.
Contributor PHP Object Injection in Icegram
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
01/10/2026
[CVE-2026-94390] Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.
Editor PHP Object Injection in Hide Shipping Method For WooCommerce
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-102108] An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serializ…
An authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that was deserialized without sufficient validation, potentially allowing arbitrary code execution in the context of the gateway service account. Exploitation requires an administrator account holding a specific queue-management privilege.
nvdaltovulnerabilidad CVSS 7.2 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
30/09/2026
[CVE-2026-102101] Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserializ…
Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under certain conditions, allow crafted data to be deserialized unsafely, potentially resulting in remote code execution on the appliance. Exploitation depends on an attacker first being able to influence the affected data, so this issue is not exploitable on …
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-97256] Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.
Editor PHP Object Injection in Page Builder by SiteOrigin
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-97291] Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-102377] Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.
Contributor PHP Object Injection in Photo Gallery by 10Web
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
30/09/2026
[CVE-2026-102392] Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons a…
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields
nvdaltovulnerabilidad CVSS 7.2 NVD