Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "X" — 17538 resultados ✕ Limpiar búsqueda
24,658
Total alertas
5025
Críticas
18870
Altas
8
Ransomware
2776
Esta semana
RSS
M Alto vulnerabilidad
08/09/2026
[CVE-2026-16037] Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. P…
Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API (v9x) WHMCS Module: from v9.0.0 before v9.0.3.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-86665] A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the functio…
A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of the file controllers/update.php. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Crítico vulnerabilidad
08/09/2026
[CVE-2026-61516] Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that…
Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the exposed credential against the login handler to establish a fully authenticated administrator session …
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-61517] Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the…
Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a shell command executed through system() with an incomplete denylist that only blocks spaces, pipes, semi…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Crítico vulnerabilidad
08/09/2026
[CVE-2026-12744] A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a …
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
08/09/2026
[CVE-2026-12745] A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a …
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
08/09/2026
[CVE-2026-12645] A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authe…
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
nvdcriticovulnerabilidad CVSS 9.9 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
08/09/2026
[CVE-2026-12646] A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authe…
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
08/09/2026
[CVE-2026-12647] A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authe…
A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-12648] A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a …
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Crítico vulnerabilidad
08/09/2026
[CVE-2026-12650] A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a …
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-12651] A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a …
A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-79377] A heap overflow in the a2dp_decoder_sbc.cpp component of Bestechnic Co., Ltd BES2300 Bluetooth Audio…
A heap overflow in the a2dp_decoder_sbc.cpp component of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Service (DoS) via sending a crafted L2CAP packet.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-79376] An issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firm…
An issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Service (DoS) via sending a crafted L2CAP packet.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-74239] XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windo…
XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by using backslash-based traversal sequences in ZIP member names. Attackers can craft a malicious ZIP archive with backslash path separators tha…
nvdaltovulnerabilidad CVSS 7.2 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
08/09/2026
[CVE-2026-73311] XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attacker…
XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code. Attackers can exploit the failure to invalidate or mark authorization codes as consumed after initial token issuance to receive an independent token pair for the same user and scopes, bypassing the single-use gu…
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-73312] XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a…
XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime.
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-73314] XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handl…
XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported auth_algo header value. When the algorithm cannot be mapped to a supported hash function, the verification function incorrectly returns true instead of failing, causing…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-73315] XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhoo…
XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme, hostname, or allowlist validation. Attackers can submit a crafted POST to the PayPal webhook callback…
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-73316] XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider th…
XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate payment events, resulting in repeated subscription activations and unauthorized account upgrades.
nvdaltovulnerabilidad CVSS 7.5 NVD