Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,696
Total alertas
3097
Críticas
10327
Altas
8
Ransomware
1772
Esta semana
RSS
M Alto vulnerabilidad
30/07/2026
[CVE-2026-15397] The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all…
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via the wps_sfw_install_plugin_configuration AJAX handler. This makes it possible for authenticated attackers, with shop manager-level access and above, to install a…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-22620] Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware…
Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass authentication and gain a privileged user access to the device.
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-22621] Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PA…
Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to execute arbitrary commands within a restricted environment.
nvdaltovulnerabilidad CVSS 8.3 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-22622] Improper input validation in one of the session management interface of Eaton's Tripp Lite series PA…
Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate privileges resulting in unrestricted access to the device.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-18360] The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site sc…
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-18361] The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site sc…
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function.
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-16969] The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site sc…
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.
nvdaltovulnerabilidad CVSS 7.6 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
30/07/2026
[CVE-2026-44106] A privilege escalation vulnerability in the init-script for user-applications allows a low-privilege…
A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-44107] A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefor…
A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the port that CharxModbusServer is listening, an unauthenticated attacker can perform a Denial-of-Service attack.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2026-44108] Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematur…
Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window in which internal services may become externally accessible, potentially allowing an unauthenticated remote attacker to connect to these services, resulting in full system compromise.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2026-7849] Due to improper neutralization of special elements, an unauthenticated remote attacker is able to in…
Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-44099] A privilege escalation vulnerability in the system configuration allows a low-privileged local user …
A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2026-44100] The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points.…
The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial-of-Service and files tampering.
nvdcriticovulnerabilidad CVSS 9.4 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2026-44101] Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker…
Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection. This can lead to Denial-of-Service and confidential data being disclosed to the attacker.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
30/07/2026
[CVE-2026-44104] The firmware update process for the basemodule of the charging controller only validates the CRC32 c…
The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
30/07/2026
[CVE-2026-44092] An unauthenticated remote attacker can inject malicious input into the ModbusServer application beca…
An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-44093] A local privilege escalation vulnerability in the init-script for user-applications allows a low-pri…
A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-44094] An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with …
An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Charging could be interrupted.
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-44095] A privilege escalation vulnerability in a script used for network configuration allows a low-privile…
A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
30/07/2026
[CVE-2026-44096] A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary …
A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise.
nvdaltovulnerabilidad CVSS 7.8 NVD