Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,082
Total alertas
4667
Críticas
16827
Altas
8
Ransomware
1014
Esta semana
RSS
cwe-502 × Limpiar todo ×
M Crítico vulnerabilidad
09/06/2026
[CVE-2026-26142] Deserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute c…
Deserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute code over a network.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
09/06/2026
[CVE-2026-8365] The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Executi…
The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the 'blocksy_meta' REST API field and the V200 database migration in versions up to and including 2.1.35. This is due to insufficient input sanitization in the blocksy_sanitize_post_meta_options() function, which only blocks values containing '' and does not prevent serialized PHP obj…
nvdaltovulnerabilidad CVSS 8.8 NVD
V Alto vulnerabilidad
09/06/2026
[CVE-2026-41855] In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageCon…
In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions via gadget class deserialization. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 t…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
05/06/2026
[CVE-2026-7654] The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection leading to Remote Code …
The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution in versions up to and including 7.0.18. This is due to the use of `unserialize()` without an `allowed_classes` restriction in the `IdsToCollection::get_ids_from_string()` function, which processes attacker-controlled post meta values without proper validation. This makes it possible for au…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Crítico vulnerabilidad
04/06/2026
[CVE-2026-25550] Seagull Software BarTender 2010, 2016, and 2019 contain an unauthenticated remote code execution vul…
Seagull Software BarTender 2010, 2016, and 2019 contain an unauthenticated remote code execution vulnerability in the .NET Remoting service exposed on TCP port 7375 via BtSystem.Service.exe. The service registers an unauthenticated singleton endpoint — BarTenderSystem for BarTender 2016
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
04/06/2026
[CVE-2026-25551] Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability…
Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-privileged local users to escalate privileges. The DataServiceSingleton .NET Remoting endpoint is bound to localhost on TCP port 7375 via BtSystem.Service.exe, limiting the attack surface to local access only. The endpoint is configured with BinaryServerFormatterSinkProvider and Typ…
nvdaltovulnerabilidad CVSS 7.8 NVD
A Crítico vulnerabilidad
04/06/2026
[CVE-2026-50076] Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK…
Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks and invoke classpath-present readResolve/readExternal hooks via crafted Fory serialized data. Users are recommended to upgrade to version 1.1.0 or later, which fixes thi…
nvdcriticovulnerabilidad CVSS 9.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
A Crítico vulnerabilidad
03/06/2026
[CVE-2026-47065] ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Pro…
ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.readProxyDesc() is dispatched. JDK then calls the default ObjectInputStream.resolveProxyClass(interfaces) implementation, which perform…
nvdcriticovulnerabilidad CVSS 9.8 NVD
S Alto vulnerabilidad
02/06/2026
[CVE-2026-42211] React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a c…
React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized …
nvdaltovulnerabilidad CVSS 8.1 NVD
N Alto vulnerabilidad
02/06/2026
[CVE-2026-24221] NVIDIA NVTabular contains a vulnerability where an attacker could cause improper deserialization of …
NVIDIA NVTabular contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering and information disclosure.
nvdaltovulnerabilidad CVSS 7.8 NVD
N Alto vulnerabilidad
02/06/2026
[CVE-2026-24237] NVIDIA NVTabular contains a vulnerability where an attacker could cause improper deserialization of …
NVIDIA NVTabular contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
02/06/2026
[CVE-2026-39555] Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. Thi…
Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. This issue affects Askka: from n/a through 1.3.1.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
02/06/2026
[CVE-2026-39550] Deserialization of Untrusted Data vulnerability in Elated-Themes Aperitif allows Object Injection. …
Deserialization of Untrusted Data vulnerability in Elated-Themes Aperitif allows Object Injection. This issue affects Aperitif: from n/a through 1.6.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
02/06/2026
[CVE-2026-39551] Deserialization of Untrusted Data vulnerability in Elated-Themes Töbel allows Object Injection. Thi…
Deserialization of Untrusted Data vulnerability in Elated-Themes Töbel allows Object Injection. This issue affects Töbel: from n/a through 1.8.1.
nvdaltovulnerabilidad CVSS 8.1 NVD