Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 1 hora
22,162
Total alertas
4698
Críticas
16876
Altas
8
Ransomware
1037
Esta semana
RSS
cwe-918 × Limpiar todo ×
M Alto vulnerabilidad
03/07/2026
[CVE-2026-57993] Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacke…
Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
nvdaltovulnerabilidad CVSS 7.4 NVD
M Crítico vulnerabilidad
03/07/2026
[CVE-2026-22874] Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration a…
Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Alto vulnerabilidad
03/07/2026
[CVE-2026-10055] In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker…
In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the HTTP request server-side, and returns the full response body to the caller. Because the destination URL is neither validated nor allowlisted, a remote attacker with access to the Theia service co…
nvdaltovulnerabilidad CVSS 8.5 NVD
M Crítico vulnerabilidad
02/07/2026
[CVE-2026-45499] Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileg…
Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
02/07/2026
[CVE-2026-57100] Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an au…
Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Alto vulnerabilidad
02/07/2026
[CVE-2026-59095] LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows au…
LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service (importFromUrl) and topic cover update (fetchImageFromUrl) endpoints, which use the global fetch without the project's ssrf-safe-fetch wrapper. Attackers can target…
nvdaltovulnerabilidad CVSS 7.7 NVD
U Alto vulnerabilidad
02/07/2026
[CVE-2026-55113] A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vuln…
A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vulnerability found in UniFi Talk Application to execute a Denial of Service (DoS) attack and bypass authentication in certain UniFi Talk API endpoints.
nvdaltovulnerabilidad CVSS 7.5 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
U Crítico vulnerabilidad
02/07/2026
[CVE-2026-55115] A malicious actor with access to the network and low privileges could exploit a Server-Side Request …
A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application to escalate privileges on the host device.
nvdcriticovulnerabilidad CVSS 9.9 NVD
U Alto vulnerabilidad
02/07/2026
[CVE-2026-54401] A malicious actor with access to the network and low privileges could exploit a Server-Side Request …
A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
02/07/2026
[CVE-2026-57348] Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions <= 3.0.4 versions.
Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
02/07/2026
[CVE-2026-14336] PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' …
PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py:139) instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer such as https://ci.eclipse.org@evil.host (userinfo trick) or https://ci.eclipse.org.evil.host (suffix trick) that satisfies the prefix…
nvdaltovulnerabilidad CVSS 8.2 NVD
N Alto vulnerabilidad
01/07/2026
[CVE-2026-24242] NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause server-side …
NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.
nvdaltovulnerabilidad CVSS 7.8 NVD
I Alto vulnerabilidad
30/06/2026
[CVE-2026-11714] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side re…
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled.
nvdaltovulnerabilidad CVSS 8.5 NVD
L Alto vulnerabilidad
30/06/2026
[CVE-2026-10546] IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in …
IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL component ( src/lfx/src/lfx/components/data_source/url.py ) due to a Time-of-Check/Time-of-Use (TOCTOU) race condition that can be exploited via DNS rebinding.
nvdaltovulnerabilidad CVSS 7.1 NVD
L Alto vulnerabilidad
30/06/2026
[CVE-2026-10564] IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSRe…
IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSReaderComponent in rss.py and SearXNG component in searxng.py make unvalidated HTTP requests to user-controlled URLs, bypassing SSRF protections introduced in version 1.9.3. An authenticated attacker can exploit this to access internal resources including cloud metadata services (AWS/Azure/GCP IMDS), …
nvdaltovulnerabilidad CVSS 8.2 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
I Alto vulnerabilidad
30/06/2026
[CVE-2026-11546] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side re…
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.
nvdaltovulnerabilidad CVSS 7.1 NVD
L Alto vulnerabilidad
30/06/2026
[CVE-2026-10129] IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass…
IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass vulnerability in the API Request component. An authenticated attacker with low-level privileges (flow author role) can bypass SSRF protections by enabling the follow_redirects parameter and supplying a public URL that redirects to internal/localhost addresses. The vulnerability exists because the a…
nvdaltovulnerabilidad CVSS 8.5 NVD
A Alto vulnerabilidad
30/06/2026
[CVE-2026-48285] ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Request Forgery (SSRF)…
ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
29/06/2026
[CVE-2026-57947] Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registrat…
Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
29/06/2026
[CVE-2026-56285] Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and use…
Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs. Attackers can retrieve HTTP responses from any host reachable by the server, including cloud metadata services and internal network resources.
nvdaltovulnerabilidad CVSS 8.6 NVD