Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,434
Total alertas
3054
Críticas
10108
Altas
8
Ransomware
1778
Esta semana
RSS
cwe-352 × Limpiar todo ×
M Alto vulnerabilidad
09/07/2026
[CVE-2026-59148] Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-ser…
Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: * with write methods allowed, and has no authentication. Any unauthenticated caller who can reach the mock server port can…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
09/07/2026
[CVE-2026-4275] The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to …
The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to the use of '__return_true' as the permission_callback for the /install_plugin and /activate_plugin REST API endpoints, which bypasses WordPress's built-in REST API nonce verification. Although the endpoint callbac…
nvdaltovulnerabilidad CVSS 8.8 NVD
O Alto vulnerabilidad
07/07/2026
[CVE-2026-49471] Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilitie…
Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port, with no authentication, no CSRF protection, and no Host header validation. A DNS rebinding attack allows a malicious webpage to reach this API from any browser and write arbitrary c…
nvdaltovulnerabilidad CVSS 8.3 NVD
M Alto vulnerabilidad
07/07/2026
[CVE-2026-34171] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GET /invitations/{uuid} endpoint can perform a state-changing password reset using an attacker-known invitation UUID, allowing an attacker who can cause a victim to visit the crafted invitation URL to reset the victim account password to a predictable value. This issue i…
nvdaltovulnerabilidad CVSS 8.0 NVD
M Alto vulnerabilidad
06/07/2026
[CVE-2026-59713] Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally …
Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
04/07/2026
[CVE-2026-12740] Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter…
Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter. RequestTokenV2 builds the provider authorization redirect without issuing a state value, and AccessTokenV2 exchanges the callback code and registers the resulting token into the session (register_session) without verifying that the callback corresponds to an authorization request this session ini…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
04/07/2026
[CVE-2026-12746] Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 st…
Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter. The authentication_url method builds the provider authorization redirect without issuing a state value, and the callback method exchanges the callback code and registers the resulting token into the session without verifying that the callback corresponds to an authorization request t…
nvdaltovulnerabilidad CVSS 8.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
02/07/2026
[CVE-2026-57761] Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP <= 3.12.2 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
02/07/2026
[CVE-2026-57766] Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor <= 3.5.6 ver…
Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
02/07/2026
[CVE-2026-57757] Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
02/07/2026
[CVE-2026-57758] Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce <= 1.0.8.2 ve…
Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
02/07/2026
[CVE-2026-57759] Unauthenticated Cross Site Request Forgery (CSRF) in ProfileGrid <= 5.9.9.7 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in ProfileGrid
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
02/07/2026
[CVE-2026-57751] Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login <= 1.1.39 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
01/07/2026
[CVE-2026-57723] Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS al…
Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Path Traversal. This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.12.
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
01/07/2026
[CVE-2026-12158] The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-S…
The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0.9.1. This is due to missing or incorrect nonce validation on the process_request function. This makes it possible for unauthenticated attackers to escalate the privileges of an arbitrary form submitter to administrator by creating a malic…
nvdaltovulnerabilidad CVSS 8.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
A Alto vulnerabilidad
29/06/2026
[CVE-2026-43735] The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and i…
The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may exfiltrate data cross-origin.
nvdaltovulnerabilidad CVSS 8.1 NVD
B Alto vulnerabilidad
26/06/2026
[CVE-2026-50132] Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token…
Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token/handoff` is a public endpoint (no auth required) that performs a permanent, state-changing operation: it binds an external chat identity (Slack/Discord/MS Teams) to an authenticated Budibase user account, with no consent UI and no CSRF protection. The session token in the URL is created by the atta…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-52784] OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there…
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a CSRF on TARGET through /users/:id via POST parameter "user[admin]". This vulnerability is fixed in 17.3.3 and 17.4.1.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-57659] Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <=…
Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-57655] Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard
nvdaltovulnerabilidad CVSS 8.2 NVD