Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 22 min
26,236
Total alertas
5271
Críticas
20093
Altas
8
Ransomware
1713
Esta semana
RSS
M Crítico vulnerabilidad
08/09/2026
[CVE-2026-86509] A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of t…
A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack can only be done within the local network. The exploit has been published and may be used.
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-76958] SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources i…
SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the attacker to read sensitive file contents from the server and expose them through monitoring or logging…
nvdaltovulnerabilidad CVSS 8.5 NVD
M Crítico vulnerabilidad
08/09/2026
[CVE-2026-66768] SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked fro…
SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on the confidentiality, integrity, and avai…
nvdcriticovulnerabilidad CVSS 9.0 NVD
M Crítico vulnerabilidad
08/09/2026
[CVE-2026-58240] SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application…
SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confide…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-66767] SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a…
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation could result in high impact on confidentiality and integrity, with low impact on availability of the applic…
nvdaltovulnerabilidad CVSS 7.7 NVD
M Crítico vulnerabilidad
08/09/2026
[CVE-2026-44756] A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Und…
A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. Successful exploitation may have a high impact on the confidentiality, integrity, and availabil…
nvdcriticovulnerabilidad CVSS 10.0 NVD
F Medio vulnerabilidad
08/09/2026
Arbitrary process termination from exposed minifilter communication port
Fortinet PSIRT publica advisory de seguridad: Arbitrary process termination from exposed minifilter communication port. Tipo: Vulnerabilidad de seguridad. Producto afectado: Forticlient.
firewallforticlient PAN PSIRT

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
F Alto vulnerabilidad
08/09/2026
Broken Access control on Websocket streams
Fortinet PSIRT publica advisory de seguridad: Broken Access control on Websocket streams. Tipo: Control de Acceso Inadecuado. Producto afectado: Fortisoar.
firewall PAN PSIRT
F Medio vulnerabilidad
08/09/2026
Cron Job Injection in Remote Backup
Fortinet PSIRT publica advisory de seguridad: Cron Job Injection in Remote Backup. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortisandbox.
firewallfortisandbox PAN PSIRT
F Crítico vulnerabilidad
08/09/2026
JWT used for authentication in web GUI signed with static key
Fortinet PSIRT publica advisory de seguridad: JWT used for authentication in web GUI signed with static key. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortimonitor.
firewall PAN PSIRT
F Medio vulnerabilidad
08/09/2026
Null Pointer Dereference in Log Report
Fortinet PSIRT publica advisory de seguridad: Null Pointer Dereference in Log Report. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortios.
firewallfortios PAN PSIRT
F Medio vulnerabilidad
08/09/2026
Open Redirect on FortiSIEM
Fortinet PSIRT publica advisory de seguridad: Open Redirect on FortiSIEM. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortisiem.
firewall PAN PSIRT
F Crítico vulnerabilidad
08/09/2026
Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information
Fortinet PSIRT publica advisory de seguridad: Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information. Tipo: Control de Acceso Inadecuado. Producto afectado: Fortisandbox.
firewallfortisandbox PAN PSIRT
F Crítico vulnerabilidad
08/09/2026
Uncontrolled Resource Consumption in SNMP
Fortinet PSIRT publica advisory de seguridad: Uncontrolled Resource Consumption in SNMP. Tipo: Denegación de Servicio (DoS). Producto afectado: Fortianalyzer.
firewallfortianalyzer PAN PSIRT
F Alto vulnerabilidad
08/09/2026
Workflow session email approval process bypass
Fortinet PSIRT publica advisory de seguridad: Workflow session email approval process bypass. Tipo: Control de Acceso Inadecuado. Producto afectado: Fortimanager.
firewallfortimanager PAN PSIRT

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
F Crítico vulnerabilidad
08/09/2026
ZTNA Portal Improper Certificate Validation
Fortinet PSIRT publica advisory de seguridad: ZTNA Portal Improper Certificate Validation. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortios.
firewallfortios PAN PSIRT
M Crítico vulnerabilidad
07/09/2026
[CVE-2026-86542] knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated a…
knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files writable by the server process.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
07/09/2026
[CVE-2026-86543] knowns versions before 0.30.0 serve the management API without authentication on all network interfa…
knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86544] knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code acti…
knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86439] knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing atta…
knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files accessible to the server process.
nvdaltovulnerabilidad CVSS 8.8 NVD