Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Multiple Vendors" — 1154 resultados ✕ Limpiar búsqueda
22,298
Total alertas
4744
Críticas
16966
Altas
8
Ransomware
1168
Esta semana
RSS
7 días × Limpiar todo ×
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-87782] The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change role…
The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-87971] The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a requ…
The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-105316] The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some …
The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-104677] The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution featu…
The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromise the site.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Crítico vulnerabilidad
Hace 3 días
[CVE-2026-59346] VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with loca…
VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Affected versions: - VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) - VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-59347] VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicio…
VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerability in HGFS. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. Affected versions: - VMware Workstation: 25H2, 26H1 (fixed in 26H1u1) - VMware Fusion: 25H2, 26H1 (fixed in 26H1u1)
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-102173] The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable t…
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in `ExceptionalElements::image_element()`, which concatenates a user-meta value straight into an `` attribute. This makes it possible for unauthentica…
nvdaltovulnerabilidad CVSS 7.2 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-106471] A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any o…
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. When target resource identifiers are known, this c…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-97673] IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitra…
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-97674] IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitra…
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command ('Code Injection'), aka improper control of code generation.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-97676] IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitra…
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code, resulting in a sandbox escape.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-97678] IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitra…
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-97679] IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitra…
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command ('Code Injection') related to improper input validation.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-97680] IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitiv…
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem.
nvdaltovulnerabilidad CVSS 8.3 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-93449] IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitra…
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.
nvdaltovulnerabilidad CVSS 8.5 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
Hace 3 días
[CVE-2026-93674] IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to…
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-93675] IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to…
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-93677] IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitiv…
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to exposure of sensitive information to an unauthorized actor.
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-93678] IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitiv…
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
Hace 3 días
[CVE-2026-97655] IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to…
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an incomplete blocklist in the code security scanner.
nvdaltovulnerabilidad CVSS 8.8 NVD