Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,113
Total alertas
4677
Críticas
16848
Altas
8
Ransomware
1013
Esta semana
RSS
cwe-862 × Limpiar todo ×
M Alto vulnerabilidad
26/06/2026
[CVE-2026-55188] RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, …
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket replication admin API. The ListRemoteTargetHandler handler for listing remote replication targets only checks whether request credentials exist, but does not verify that the caller has replication or administrator permissions. As a result, an aut…
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-55189] RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, …
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, when the FTP frontend is enabled, the FTP read and probe handlers dispatch directly to the storage backend without ever calling the IAM authorization function that the FTP write/list handlers (and the entire HTTP S3 path) use. As a result, any user who can authenticate to the FTP listener — includin…
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-49991] RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users wi…
RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely breaking multi-tenant isolation. The vulnerability chains three flaws: No ../ sanitization in tar entry ke…
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-47193] OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the j…
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-57518] Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users wit…
Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the 'user: manage users' permission to escalate privileges by assigning arbitrary custom roles to themselves due to missing authorization checks in UserApiController::saveAction(). Attackers can assign themselves a custom role with the 'system: manage packages' permission and then upload and insta…
nvdaltovulnerabilidad CVSS 8.8 NVD
C Alto vulnerabilidad
26/06/2026
[CVE-2026-12411] Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrust…
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.
nvdaltovulnerabilidad CVSS 8.4 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-57645] newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions.
newsletters_subscribers Broken Access Control in Newsletters
nvdaltovulnerabilidad CVSS 8.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
26/06/2026
[CVE-2026-56773] Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenti…
Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenticated user to bypass authorization checks. Attackers can read table schemas, create tables, and modify or delete records across bases and tables via endpoints like GET /api/v2/tables/get and POST /api/v2/tables/updateRecords.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-56061] Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions.
Unauthenticated Broken Access Control in Subscriptions for WooCommerce
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-56063] Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.
Unauthenticated Broken Access Control in MailChimp Block
nvdaltovulnerabilidad CVSS 8.3 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-56038] Contributor Privilege Escalation in Frisbii Pay <= 1.8.2 versions.
Contributor Privilege Escalation in Frisbii Pay
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-56025] Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.
Unauthenticated Broken Access Control in Paymob for WooCommerce
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-54835] Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.
Unauthenticated Broken Access Control in Five Star Restaurant Menu
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-54837] Unauthenticated Broken Access Control in Intranet &amp; Private Site &#8211; All-In-One Intranet <= …
Unauthenticated Broken Access Control in Intranet &amp; Private Site &#8211; All-In-One Intranet
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-54840] Unauthenticated Broken Access Control in Newsletters <= 4.13 versions.
Unauthenticated Broken Access Control in Newsletters
nvdaltovulnerabilidad CVSS 7.3 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
26/06/2026
[CVE-2026-54846] Unauthenticated Broken Access Control in Syncee Premium Dropshipping &amp; Wholesale <= 1.0.27 versi…
Unauthenticated Broken Access Control in Syncee Premium Dropshipping &amp; Wholesale
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-54847] Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions.
Unauthenticated Broken Access Control in Stylish Cost Calculator
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-54832] Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions.
Unauthenticated Broken Access Control in Gutenverse Companion
nvdaltovulnerabilidad CVSS 7.5 NVD
B Alto vulnerabilidad
25/06/2026
[CVE-2026-57520] Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authentic…
Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in the bulk user-remove endpoint. Attackers can supply Admin organization-user IDs in a bulk DELETE request to bypass the guard enforced on the single-user removal…
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
25/06/2026
[CVE-2026-56767] Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storag…
Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storage and webhook API handlers that allows authenticated users to access other users' robots and OAuth tokens. Attackers can read plaintext Google and Airtable access tokens, modify, delete, or execute other users' robots by bypassing ownership checks in API endpoints.
nvdaltovulnerabilidad CVSS 8.8 NVD