Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
14,046
Total alertas
3206
Críticas
10568
Altas
8
Ransomware
1050
Esta semana
RSS
vulnerabilidad × Limpiar todo ×
I Alto vulnerabilidad
30/06/2026
[CVE-2026-11594] IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in…
IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console.
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
30/06/2026
[CVE-2026-13207] FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path no…
FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path normalization in the REST API. The API router fails to normalize dot-segment sequences before applying authentication middleware, allowing unauthenticated requests to access protected endpoints by prefixing paths with dot-segments such as /api/./users, /api/./roles, and /api/project/../users. These re…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
30/06/2026
[CVE-2026-44628] An unauthenticated attacker can crash the worklist server with a single crafted query when the serve…
An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid Called AE Title / storage directory, the expected lockfile, and at least one matching worklist record.
nvdaltovulnerabilidad CVSS 7.5 NVD
L Crítico vulnerabilidad
30/06/2026
[CVE-2026-7663] IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP p…
IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.
nvdcriticovulnerabilidad CVSS 9.1 NVD
L Crítico vulnerabilidad
30/06/2026
[CVE-2026-7803] IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validatio…
IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields.
nvdcriticovulnerabilidad CVSS 9.8 NVD
L Crítico vulnerabilidad
30/06/2026
[CVE-2026-7871] IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with …
IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with full application privileges, compromising all secrets, data, and system integrity.
nvdcriticovulnerabilidad CVSS 9.8 NVD
L Crítico vulnerabilidad
30/06/2026
[CVE-2026-7873] IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS command…
IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.
nvdcriticovulnerabilidad CVSS 9.9 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
L Crítico vulnerabilidad
30/06/2026
[CVE-2026-7874] IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due …
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due to the use of a weak and reversible key derivation mechanism for encryption at rest.
nvdcriticovulnerabilidad CVSS 9.1 NVD
I Alto vulnerabilidad
30/06/2026
[CVE-2026-13772] IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacke…
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at three distinct sinks (SELECT NEW, enum literals, and reflection-based comparators); an authenticated remote attacker who can influence an application-built OQL query string can execute arbitrary construct…
nvdaltovulnerabilidad CVSS 7.5 NVD
I Alto vulnerabilidad
30/06/2026
[CVE-2026-11714] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side re…
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled.
nvdaltovulnerabilidad CVSS 8.5 NVD
I Alto vulnerabilidad
30/06/2026
[CVE-2026-11806] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary fil…
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.
nvdaltovulnerabilidad CVSS 7.2 NVD
I Alto vulnerabilidad
30/06/2026
[CVE-2026-13449] IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external e…
IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
nvdaltovulnerabilidad CVSS 7.6 NVD
I Alto vulnerabilidad
30/06/2026
[CVE-2026-13759] IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObje…
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver) that install no JEP-290 class filter; when Coherence is on the classpath, multiple RCE gadget chains including RemoteConstructor.readResolve and PriorityQueue/ExtractorComparator are confirmed working, allowing a post-lo…
nvdaltovulnerabilidad CVSS 7.5 NVD
L Crítico vulnerabilidad
30/06/2026
[CVE-2026-10140] IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows…
IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to be processed using incorrect upstream API credentials, leading to cross-tenant billing and accountability misattribution.
nvdcriticovulnerabilidad CVSS 9.6 NVD
L Alto vulnerabilidad
30/06/2026
[CVE-2026-10546] IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in …
IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL component ( src/lfx/src/lfx/components/data_source/url.py ) due to a Time-of-Check/Time-of-Use (TOCTOU) race condition that can be exploited via DNS rebinding.
nvdaltovulnerabilidad CVSS 7.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
L Alto vulnerabilidad
30/06/2026
[CVE-2026-10560] IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/buil…
IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/ endpoints that allows an unauthenticated attacker to read build event data or cancel jobs using a valid job identifier, resulting in information disclosure and denial of service.
nvdaltovulnerabilidad CVSS 8.2 NVD
L Alto vulnerabilidad
30/06/2026
[CVE-2026-10564] IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSRe…
IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSReaderComponent in rss.py and SearXNG component in searxng.py make unvalidated HTTP requests to user-controlled URLs, bypassing SSRF protections introduced in version 1.9.3. An authenticated attacker can exploit this to access internal resources including cloud metadata services (AWS/Azure/GCP IMDS), …
nvdaltovulnerabilidad CVSS 8.2 NVD
I Alto vulnerabilidad
30/06/2026
[CVE-2026-11546] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side re…
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.
nvdaltovulnerabilidad CVSS 7.1 NVD
I Crítico vulnerabilidad
30/06/2026
[CVE-2026-11708] IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in…
IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system.
nvdcriticovulnerabilidad CVSS 9.3 NVD
I Crítico vulnerabilidad
30/06/2026
[CVE-2026-11712] IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in…
IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system.
nvdcriticovulnerabilidad CVSS 9.3 NVD