Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
26,151
Total alertas
5259
Críticas
20028
Altas
8
Ransomware
1858
Esta semana
RSS
M Alto vulnerabilidad
03/09/2026
[CVE-2026-78583] Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipula…
Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding Fleet management privileges could therefore cause every Elastic Agent on a targeted policy to rece…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
03/09/2026
[CVE-2026-33630] c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-…
c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, o…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
03/09/2026
[CVE-2026-85012] Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthe…
Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprints before 0.3.156 might allow a user with permission to commit to a repository in the project to execute arbitrary commands in the blueprint resynthesis environment via shell metacharacters in the owner field of a [local] merge strategy entry…
nvdaltovulnerabilidad CVSS 8.0 NVD
M Alto vulnerabilidad
03/09/2026
[CVE-2026-85187] A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affe…
A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function Order::pupdate of the file /rider/orders/controller.php?action=edit&actions=confirm of the component Order Status Update. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publ…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
03/09/2026
[CVE-2026-83959] Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in…
Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Crítico vulnerabilidad
03/09/2026
[CVE-2026-58400] GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.…
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling Java extension functions (`ALLOW_EXTERNAL_FUNCTIONS`). Any stylesheet loaded by GeoNetwork can therefore invoke `java.lang.Runtime.exec()` or …
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Alto vulnerabilidad
03/09/2026
[CVE-2026-63219] GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.…
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary `.xsl` or `.zip` formatter files to the server. An unauthenticated attacker can write arbitrary files in…
nvdaltovulnerabilidad CVSS 8.6 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
G Medio vulnerabilidad
03/09/2026
Chromium: CVE-2026-84359 Information leak in Skia
Microsoft publica advisory de seguridad: Chromium: CVE-2026-84359 Information leak in Skia.
Microsoft MSRC
G Medio vulnerabilidad
03/09/2026
Chromium: CVE-2026-84358 Improper privilege management in Downloads
Microsoft publica advisory de seguridad: Chromium: CVE-2026-84358 Improper privilege management in Downloads.
Microsoft MSRC
G Medio vulnerabilidad
03/09/2026
Chromium: CVE-2026-84357 Improper input validation in Omnibox
Microsoft publica advisory de seguridad: Chromium: CVE-2026-84357 Improper input validation in Omnibox.
Microsoft MSRC
G Medio vulnerabilidad
03/09/2026
Chromium: CVE-2026-84356 UI misrepresentation in FullScreen
Microsoft publica advisory de seguridad: Chromium: CVE-2026-84356 UI misrepresentation in FullScreen.
Microsoft MSRC
G Medio vulnerabilidad
03/09/2026
Chromium: CVE-2026-84355 Incorrect authorization in Navigation
Microsoft publica advisory de seguridad: Chromium: CVE-2026-84355 Incorrect authorization in Navigation.
Microsoft MSRC
G Medio vulnerabilidad
03/09/2026
Chromium: CVE-2026-84348 Information leak in MediaCapture
Microsoft publica advisory de seguridad: Chromium: CVE-2026-84348 Information leak in MediaCapture.
Microsoft MSRC
G Medio vulnerabilidad
03/09/2026
Chromium: CVE-2026-84332 Incorrect authorization in SiteSettings
Microsoft publica advisory de seguridad: Chromium: CVE-2026-84332 Incorrect authorization in SiteSettings.
Microsoft MSRC
G Medio vulnerabilidad
03/09/2026
Chromium: CVE-2026-84331 Incorrect authorization in Actor
Microsoft publica advisory de seguridad: Chromium: CVE-2026-84331 Incorrect authorization in Actor.
Microsoft MSRC

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
G Medio vulnerabilidad
03/09/2026
Chromium: CVE-2026-84329 Confused deputy in CredentialProvider
Microsoft publica advisory de seguridad: Chromium: CVE-2026-84329 Confused deputy in CredentialProvider.
Microsoft MSRC
G Medio vulnerabilidad
03/09/2026
Chromium: CVE-2026-84328 Missing authorization in FileSystem
Microsoft publica advisory de seguridad: Chromium: CVE-2026-84328 Missing authorization in FileSystem.
Microsoft MSRC
G Medio vulnerabilidad
03/09/2026
Chromium: CVE-2026-84327 Incorrect authorization in Autofill
Microsoft publica advisory de seguridad: Chromium: CVE-2026-84327 Incorrect authorization in Autofill.
Microsoft MSRC
G Medio vulnerabilidad
03/09/2026
Chromium: CVE-2026-84323 Missing authorization in FileSystem
Microsoft publica advisory de seguridad: Chromium: CVE-2026-84323 Missing authorization in FileSystem.
Microsoft MSRC
M Alto vulnerabilidad
03/09/2026
[CVE-2026-84812] Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.
Unauthenticated Cross Site Scripting (XSS) in BP Better Messages
nvdaltovulnerabilidad CVSS 7.1 NVD