Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "X" — 17711 resultados ✕ Limpiar búsqueda
24,960
Total alertas
5077
Críticas
19076
Altas
8
Ransomware
2909
Esta semana
RSS
G Medio vulnerabilidad
28/08/2026
Chromium: CVE-2026-78962 Uninitialized resource in WebXR
Microsoft publica advisory de seguridad: Chromium: CVE-2026-78962 Uninitialized resource in WebXR.
Microsoft MSRC
G Medio vulnerabilidad
28/08/2026
Chromium: CVE-2026-78966 Externally controlled reference in QUIC
Microsoft publica advisory de seguridad: Chromium: CVE-2026-78966 Externally controlled reference in QUIC.
Microsoft MSRC
G Medio vulnerabilidad
28/08/2026
Chromium: CVE-2026-78974 UI misrepresentation in Linux Toolkit Theming
Microsoft publica advisory de seguridad: Chromium: CVE-2026-78974 UI misrepresentation in Linux Toolkit Theming.
Microsoft MSRC
G Medio vulnerabilidad
28/08/2026
Chromium: CVE-2026-79010 Operation on a resource after expiration or release in Network
Microsoft publica advisory de seguridad: Chromium: CVE-2026-79010 Operation on a resource after expiration or release in Network.
Microsoft MSRC
G Medio vulnerabilidad
28/08/2026
Chromium: CVE-2026-79017 Race condition in Extensions
Microsoft publica advisory de seguridad: Chromium: CVE-2026-79017 Race condition in Extensions.
Microsoft MSRC
G Medio vulnerabilidad
28/08/2026
Chromium: CVE-2026-79031 Improper resource exposure in Preload
Microsoft publica advisory de seguridad: Chromium: CVE-2026-79031 Improper resource exposure in Preload.
Microsoft MSRC
G Medio vulnerabilidad
28/08/2026
Chromium: CVE-2026-79068 Improper resource exposure in StreamsAPI
Microsoft publica advisory de seguridad: Chromium: CVE-2026-79068 Improper resource exposure in StreamsAPI.
Microsoft MSRC

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
28/08/2026
[CVE-2026-82082] NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remot…
NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-76053] The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulner…
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-18324] The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vuln…
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a use…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-18978] The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Co…
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A comment payload crafted exclusive…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-38820] openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injec…
openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /opennds_preauth/ endpoint because of libopennds.sh.
nvdaltovulnerabilidad CVSS 8.3 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-38821] A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenti…
A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon (denial of service) and potentially achieve remote code execution. This is in http_microhttpd.c.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Crítico vulnerabilidad
28/08/2026
[CVE-2026-61800] Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints an…
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code execution as root. During cluster file synchronization, the non-merged branch of update_master_files_in_worker…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-82072] Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execut…
Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
nvdaltovulnerabilidad CVSS 8.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
28/08/2026
[CVE-2026-78037] Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. A…
Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device compromise.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Crítico vulnerabilidad
28/08/2026
[CVE-2026-78239] Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, …
Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. Successful exploitation may permit unauthorized access to the device.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
28/08/2026
[CVE-2026-76943] Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allo…
Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to complete device compromise.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-76060] An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionalit…
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Crítico vulnerabilidad
28/08/2026
[CVE-2026-76179] An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway produ…
An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session information to obtain and reuse a valid token. Successful exploitation could allow an attacker to impersona…
nvdcriticovulnerabilidad CVSS 9.8 NVD