Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Multiple Vendors" — 19230 resultados ✕ Limpiar búsqueda
24,960
Total alertas
5077
Críticas
19076
Altas
8
Ransomware
2923
Esta semana
RSS
M Alto vulnerabilidad
04/09/2026
[CVE-2026-77822] IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive informa…
IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Crítico vulnerabilidad
04/09/2026
[CVE-2026-75160] An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via th…
An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
04/09/2026
[CVE-2026-44402] Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in …
Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a malicious tar archive containing arbitrary executable files that are extracted to a privileged directory and…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-19303] IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrar…
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-19304] IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitiv…
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-19305] IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information …
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery.
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-19306] IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from …
IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material (secret_key, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories) — by supplying absolute paths or traversal sequences in the files parameter of an authenticated build request. The file content…
nvdaltovulnerabilidad CVSS 7.7 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
04/09/2026
[CVE-2026-19300] IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information …
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
04/09/2026
[CVE-2026-18658] IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.…
IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-18905] IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) <= v1.0.6 MCP Context Forge could allow a …
IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`)
nvdaltovulnerabilidad CVSS 7.7 NVD
M Crítico vulnerabilidad
04/09/2026
[CVE-2026-19274] IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator coul…
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR name with no namespace disambiguation, allowing a same-named `InstanaAgent` CR in an attacker-controlle…
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-19283] IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator coul…
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system namespace into an attacker-controlled namespace.
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-19298] IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitra…
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2022-35499] In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site …
In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Crítico vulnerabilidad
04/09/2026
[CVE-2026-85696] SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded …
SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execute arbitrary system commands when video generation occurs.
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
04/09/2026
[CVE-2026-85699] jina-ai reader contains a server-side request forgery vulnerability where URL validation is performe…
jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, allowing the server to fetch and return the target's response body to the attacker.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-85691] MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /…
MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON response.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
04/09/2026
[CVE-2026-85694] LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract…
LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute arbitrary code on the operator's host without review.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Crítico vulnerabilidad
04/09/2026
[CVE-2026-85695] FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allow…
FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious workers under victim model names to intercept user prompts, images, and responses, or probe internal network ports across the worker mesh.
nvdcriticovulnerabilidad CVSS 9.4 NVD
M Crítico vulnerabilidad
04/09/2026
[CVE-2026-85684] marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler t…
marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existing files on the system.
nvdcriticovulnerabilidad CVSS 9.1 NVD