Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "X" — 10500 resultados ✕ Limpiar búsqueda
14,077
Total alertas
3213
Críticas
10592
Altas
8
Ransomware
1074
Esta semana
RSS
J Alto vulnerabilidad
07/07/2026
[CVE-2026-48948] An improper access check allows user to download vcard exports of com_contact contacts that are inac…
An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
07/07/2026
[CVE-2026-23698] Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin …
Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows administrator-level attackers to upload arbitrary PHP files by submitting a crafted zip archive through the ModuleManager import function, which extracts contents directly into the modules/ directory under the web root without validating file types beyond the manife…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
07/07/2026
[CVE-2026-57851] MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys ker…
MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory read/write and unrestricted I/O port operations by accessing exposed IOCTL handlers without administrator privileges. Attackers can exploit the accessible device object through IOCTL handlers to manipulate kernel …
nvdaltovulnerabilidad CVSS 7.8 NVD
E Crítico vulnerabilidad
07/07/2026
[CVE-2026-13019] Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing aut…
Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API.
nvdcriticovulnerabilidad CVSS 9.8 NVD
E Alto vulnerabilidad
07/07/2026
[CVE-2026-13020] A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions …
A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
07/07/2026
[CVE-2026-23697] Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileg…
Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file containing arbitrary PHP code through the Documents module, bypassing the extension denylist in config.inc.php which omits the .phar extension. The uploaded file is stored with its original .phar extension under the web-accessible s…
nvdaltovulnerabilidad CVSS 8.8 NVD
P Alto vulnerabilidad
07/07/2026
[CVE-2026-56811] Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix (Phoe…
Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix (Phoenix.Socket module) allows an unauthenticated attacker to cause a denial of service against any endpoint that mounts a Phoenix socket with a reachable channel transport (WebSocket or LongPoll). This vulnerability is associated with program files lib/phoenix/socket.ex and program routine 'Elixir.Phoe…
nvdaltovulnerabilidad CVSS 7.5 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
P Alto vulnerabilidad
07/07/2026
[CVE-2026-56812] Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Pres…
Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript client) allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every viewer of a presence channel topic. This vulnerability is associated with program files assets/js/phoenix/presence.js and program routines Presence.syncState and…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
07/07/2026
[CVE-2026-6101] The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write…
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including 1.1.12. This is due to unsafe ZIP file extraction in the ampforwp_save_local_font() function combined with inadequate cleanup that fails to remove nested directories and files. This makes it possible for authenticated attackers, with Author-level access and above, an…
nvdaltovulnerabilidad CVSS 7.5 NVD
D Alto vulnerabilidad
07/07/2026
[CVE-2026-53479] Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through…
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command ('OS command Injection') vulnerability. A remote high privileged attacker could potentially exploit this vulne…
nvdaltovulnerabilidad CVSS 7.2 NVD
D Crítico vulnerabilidad
07/07/2026
[CVE-2026-53481] Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through…
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vuln…
nvdcriticovulnerabilidad CVSS 9.8 NVD
D Crítico vulnerabilidad
07/07/2026
[CVE-2026-53483] Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through…
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 an improper authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access. This is a critical s…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
07/07/2026
[CVE-2011-10043] Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Mo…
Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Module names starting with "::" could be passed to the load function to specify arbitrary module paths. Attackers able to influence module names passed to load could use that bug to execute arbitrary code.
nvdcriticovulnerabilidad CVSS 9.8 NVD
A Crítico vulnerabilidad
07/07/2026
[CVE-2026-33264] A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-contro…
A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Us…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
07/07/2026
[CVE-2026-11610] A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). A…
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). After a successful SASL bind with integrity protection (SSF > 0), an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that is copied into a 512-byte heap receive buffer without a bounds check in sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes o…
nvdaltovulnerabilidad CVSS 8.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
07/07/2026
[CVE-2026-14474] A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicit…
A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
07/07/2026
[CVE-2026-14476] A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() funct…
A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to auth…
nvdaltovulnerabilidad CVSS 8.0 NVD
G Alto vulnerabilidad
07/07/2026
[CVE-2026-58384] A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an unders…
A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
07/07/2026
[CVE-2026-5730] Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Se…
Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows Exploitation of Trusted Identifiers. This issue affects Ontime: through 04052026.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
07/07/2026
[CVE-2026-5799] Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Se…
Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows Exploitation of Trusted Identifiers. This issue affects Ontime: through 04052026.
nvdaltovulnerabilidad CVSS 7.5 NVD