Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Multiple Vendors" — 4749 resultados ✕ Limpiar búsqueda
13,696
Total alertas
3097
Críticas
10327
Altas
8
Ransomware
1772
Esta semana
RSS
30 días × Limpiar todo ×
M Crítico vulnerabilidad
30/07/2026
[CVE-2026-28812] UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attac…
UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges. Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-15658] A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to …
A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that returns the records of other users without checking that the caller owns the data associated with that record.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-10842] IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.…
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-67348] Julep contains an insecure direct object reference vulnerability in the get_execution_details endpoi…
Julep contains an insecure direct object reference vulnerability in the get_execution_details endpoint that allows authenticated tenants to read another tenant's execution data. Attackers can supply arbitrary execution_id values to retrieve sensitive execution records including task inputs, outputs, metadata, and temporal task tokens from other tenants.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-67349] OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded …
OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey to redirect billing calls.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-67345] MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vul…
MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches() that allows remote attackers to hijack OAuth 2.0 authorization codes by supplying a crafted redirect_uri whose hostname suffix matches a registered URI without proper dot-boundary anchoring. Attackers who control a domain ending with the registered…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-67346] Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability …
Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the _is_safe_url function that fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist. Attackers can supply user-controlled image or audio URLs that resolve to private, loopback, or metadata addresses to reach internal services and exfiltrate credentials.
nvdaltovulnerabilidad CVSS 8.6 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
30/07/2026
[CVE-2026-14980] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site req…
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.
nvdaltovulnerabilidad CVSS 8.3 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2026-15435] IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a …
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-16308] IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus RES…
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-14519] IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a …
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulnerability.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-14522] IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a …
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2026-11707] IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affecte…
IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-11897] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of se…
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-11980] IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files …
IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up.
nvdaltovulnerabilidad CVSS 7.3 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
30/07/2026
[CVE-2026-12947] IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potenti…
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read by a local user.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-67351] Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password v…
Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring both use the same user record. An authenticated Editor can create a username collision with an Administrator account and obtain administrative privileges by logging in with their own password while the session loads the Administrat…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-60074] Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that …
Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture year, month and day with the `\d` shorthand, which on a character string matches the whole Unicode decimal digit property `\p{Nd}` and not just `[0-9]`. Date::Manip::Base::check then validates the captured fields with numeric comparis…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-60075] Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the un…
Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _parse_time removes a time from anywhere in the string with the unanchored substitution `s/$timerx/ /`, where $timerx is an auto-generated alternation of time patterns reached through a leading `(?:$atrx|^|\s+)`. The engine therefore retries the match at e…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-5219] Cross-Site request forgery (CSRF) vulnerability in Softtr Information Technology Trade Ltd. Co. E-Co…
Cross-Site request forgery (CSRF) vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This issue affects E-Commerce Pack: before 5.03.01.49.
nvdaltovulnerabilidad CVSS 8.3 NVD