Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,181
Total alertas
4701
Críticas
16892
Altas
8
Ransomware
1052
Esta semana
RSS
cwe-79 × Limpiar todo ×
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66612] Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions.
Unauthenticated Cross Site Scripting (XSS) in Aora
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66614] Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.
Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66597] Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.
Unauthenticated Cross Site Scripting (XSS) in wpDataTables
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66598] Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.
Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66581] Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.
Unauthenticated Cross Site Scripting (XSS) in JetEngine
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66582] Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.
Unauthenticated Cross Site Scripting (XSS) in TranslatePress
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
20/08/2026
[CVE-2026-66590] Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.
Unauthenticated Cross Site Scripting (XSS) in Tagembed
nvdaltovulnerabilidad CVSS 7.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
19/08/2026
[CVE-2026-76333] In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power"…
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action with a crafted Uniform Resource Locator (URL). When another authenticated user selects the stored action from Event Actions and selects Continue, attacker-controlled JavaScript runs in the browser of that user. This could expose data or act…
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-76325] In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power"…
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious ui-tour knowledge object that matches an auto-tour page name and share the object at the app level. The object can execute arbitrary JavaScript in the browser of another authenticated user who visits a standard Splunk Web page. The JavaScript could expose all rel…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-68900] Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip() in client/…
Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip() in client/lib/exportHTML.js read a card title and body through textContent, which decoded entity-encoded markup, and then interpolated titleText and allText into content.innerHTML in the exported index.html. A board member could store an entity-encoded event-handler payload in a card title that remained inert…
nvdaltovulnerabilidad CVSS 7.6 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-55085] Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/dom…
Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in src/node/utils/ImportEtherpad.ts accepts attacker-controlled attribute-pool values from a crafted .etherpad im…
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-75916] SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autoc…
SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup. In genHintItemHTML() (app/src/protyle/hint/extend.ts), a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can set these metadata fields on a block can inject a self-firing payload (e.g. …
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-75917] SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-t…
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation (app/src/util/pathName.ts, getLeaf()/movePathTo()) used by the 'move/link to' path-selection dialogs, where document metadata fields (bookmark, alias, memo, and an alternate name field) are concatenated into the aria-label HTML attribute without escaping. A document crafted with a …
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-73354] Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions.
Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-73182] Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.
Unauthenticated Cross Site Scripting (XSS) in BBQ Pro
nvdaltovulnerabilidad CVSS 7.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
19/08/2026
[CVE-2026-73184] Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.
Unauthenticated Cross Site Scripting (XSS) in Global Gallery
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-66596] Unauthenticated Cross Site Scripting (XSS) in Newsletter <= 9.3.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Newsletter
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-61986] Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.5 versions.
Unauthenticated Cross Site Scripting (XSS) in Contest Gallery
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
19/08/2026
Vulnerabilidad XSS almacenado en plugin TranslatePress para WordPress hasta v3.2.5
El plugin TranslatePress para WordPress contiene una vulnerabilidad de Cross-Site Scripting (XSS) almacenado sin autenticación requerida en versiones hasta 3.2.5. Los marcadores especiales '#!trpst#' y '#!trpen#' se reescriben incondicionalmente a caracteres HTML, permitiendo inyección de código malicioso. Afecta principalmente a sitios multilingües en LATAM que utilizan este plugin para traducción de contenidos.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
19/08/2026
Vulnerabilidad XSS en WP Statistics afecta sitios WordPress hasta versión 14.16.8
El plugin WP Statistics para WordPress contiene una vulnerabilidad de Cross-Site Scripting (XSS) almacenado en el parámetro 'utm_campaign' que permite a atacantes no autenticados inyectar scripts maliciosos. La falla afecta todas las versiones hasta 14.16.8 y se ejecuta cuando visitantes acceden a páginas comprometidas, poniendo en riesgo datos de usuarios y credenciales en sitios empresariales, de comercio electrónico y portales informativos comunes en LATAM.
nvdaltovulnerabilidad CVSS 7.2 NVD