Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,696
Total alertas
3097
Críticas
10327
Altas
8
Ransomware
1856
Esta semana
RSS
vulnerabilidad × Limpiar todo ×
M Alto vulnerabilidad
15/06/2026
[CVE-2026-24637] Contributor SQL Injection in PowerPress Podcasting <= 11.15.10 versions.
Contributor SQL Injection in PowerPress Podcasting
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-25425] Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions.
Unauthenticated Broken Access Control in User Registration
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-27053] Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.
Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-27089] Unauthenticated Bypass Vulnerability in WpTravelly <= 2.1.7 versions.
Unauthenticated Bypass Vulnerability in WpTravelly
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-27333] Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions.
Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2025-68840] Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions.
Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2025-68851] Unauthenticated Cross Site Scripting (XSS) in Okay Toolkit <= 2.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Okay Toolkit
nvdaltovulnerabilidad CVSS 7.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
15/06/2026
[CVE-2025-68872] Unauthenticated Cross Site Scripting (XSS) in Eli&#039;s WordCents adSense Widget with Analytics <= …
Unauthenticated Cross Site Scripting (XSS) in Eli&#039;s WordCents adSense Widget with Analytics
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2025-59133] Custom role Insecure Direct Object References (IDOR) in Projectopia <= 5.1.25.2 versions.
Custom role Insecure Direct Object References (IDOR) in Projectopia
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-53703] A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a R…
A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sample rate, channel count, and extra codec data length from fixed offsets within the chunk without fi…
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-53704] A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a…
A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using re_skip_pascal_string() without validating that offsets remain within the mapped buffer. Additionally, the element count controlling the parsing loop is read from…
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-53705] A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a special…
A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation (4 * block_samples * channels) in gst_wavpack_dec_handle_frame() causes a very small heap allocation. The WavPack library then writes decoded audio samples far beyond the allocated buffer, resulting in heap memory corruption…
nvdaltovulnerabilidad CVSS 7.6 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-50890] Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-gro…
Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /stockreports/spendings. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-50891] Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to …
Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafted request.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-52719] An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad.…
An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential informa…
nvdaltovulnerabilidad CVSS 7.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
15/06/2026
[CVE-2026-52720] A heap buffer overflow vulnerability was found in GStreamer's librfb (RFB/VNC client). The rectangle…
A heap buffer overflow vulnerability was found in GStreamer's librfb (RFB/VNC client). The rectangle bounds check incorrectly validates area rather than individual dimensions, allowing a malicious VNC server to send a rectangle that extends beyond the framebuffer. A remote attacker could set up a malicious VNC server and trick a user into connecting, resulting in an out-of-bounds heap write that c…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-52722] A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream…
A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-50881] Incorrect access control in the impworks Bonsai v6.0 allows authenticated attackers with Editor priv…
Incorrect access control in the impworks Bonsai v6.0 allows authenticated attackers with Editor privileges to escalate privileges to Administrator and execute unauthorized account, password, and configuration changes.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
15/06/2026
[CVE-2026-50882] An issue in the /api/v0/pastes endpoint of anna-is-cute paste v0.1.1 allows attackers to cause a Den…
An issue in the /api/v0/pastes endpoint of anna-is-cute paste v0.1.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-50883] An HTML injection vulnerability in the /src/highlight.rs component of matze wastebin v3.4.1 allows a…
An HTML injection vulnerability in the /src/highlight.rs component of matze wastebin v3.4.1 allows attackers to execute arbitrary scripts via a crafted payload.
nvdcriticovulnerabilidad CVSS 9.6 NVD