Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
26,120
Total alertas
5258
Críticas
20005
Altas
8
Ransomware
1910
Esta semana
RSS
M Alto vulnerabilidad
31/08/2026
[CVE-2026-82801] A vulnerability was detected in NASA earthdata-search 1.0.0. Affected by this vulnerability is the f…
A vulnerability was detected in NASA earthdata-search 1.0.0. Affected by this vulnerability is the function scaleImage of the file serverless/src/scaleImage/handler.js of the component scale Endpoint. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-82701] A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue i…
A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-66047] ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code…
ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppress_connect_process AJAX handler. Attackers can supply a caller-controlled URL through the file request parameter to trigger silent plugin …
nvdaltovulnerabilidad CVSS 8.1 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-59111] Improper neutralization of special elements used in an OS command ('OS command injection') vulnerabi…
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura (DIA) eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme (czeeopauth://) for parameterized application execution. Prior to version 3.6.0, incoming URL parameters were passed to the compiled AppleScript wrapper using concatenatio…
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-82217] In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change too…
In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent, and the replacement and state helpers) resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc, an absolute path, or a ~-expanded path could therefore write or delete files outside the workspace w…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-76763] A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly va…
A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, resulting in…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-51679] Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows …
Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
nvdcriticovulnerabilidad CVSS 9.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-51680] Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unaut…
Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify LED behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-51681] Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows un…
Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-19702] Improper neutralization of special elements used in an OS command ('OS command injection') vulnerabi…
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: from 1.0.7 before 1.0.8.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-19616] Missing Authorization vulnerability in TBC Technology Inc. KitLogistic allows Accessing Functionalit…
Missing Authorization vulnerability in TBC Technology Inc. KitLogistic allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects KitLogistic: before v2.2.2.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-82692] A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown par…
A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipulation of the argument alias/username/password/volume_location results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-82693] A vulnerability was determined in Tenda AC1206 15.03.06.23. This vulnerability affects the function …
A vulnerability was determined in Tenda AC1206 15.03.06.23. This vulnerability affects the function TendaTelnet of the file /goform/telnet of the component Web UI. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-82694] A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSe…
A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSecurityHandler of the file /goform/ate of the component Web UI. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be used.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
31/08/2026
[CVE-2026-82695] A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of th…
A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
nvdcriticovulnerabilidad CVSS 10.0 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
31/08/2026
[CVE-2026-5956] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Ankara Hosting Site Management Panel allows SQL Injection. This issue affects Site Management Panel: through 15062026.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
31/08/2026
[CVE-2026-12894] A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content l…
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Crítico vulnerabilidad
31/08/2026
Inyección de comandos OS crítica en NAS D-Link DNS-320L, DNS-327L, DNS-340L y DNS-345
Se ha identificado una vulnerabilidad crítica (CVSS 9.1) en dispositivos NAS D-Link que permite inyección de comandos del sistema operativo a través del parámetro f_ups_ip en el manejador CGI /cgi-bin/usb_device.cgi. La explotación es remota, sin autenticación requerida, y el exploit público ya circula. Afecta modelos hasta la versión 20260717, comprometiendo la integridad de servidores de almacenamiento en infraestructuras PYME y empresariales de LATAM.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
31/08/2026
Vulnerabilidad crítica en dispositivos D-Link DNS (320L, 327L, 340L, 345) permite inyección de comandos
Se detectó una vulnerabilidad crítica (CVSS 9.9) en los manejadores ISO de dispositivos de almacenamiento en red D-Link afectados hasta la versión 20260717. Un atacante remoto puede ejecutar comandos del sistema operativo a través del parámetro upIsoRootPath en /cgi-bin/isomount_mgr.cgi, comprometiendo completamente la integridad y confidencialidad de datos almacenados. El exploit está públicamente disponible y es explotable sin autenticación.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
31/08/2026
Inyección de comandos OS crítica en dispositivos D-Link DNS-327L y DNS-340L (CVE-2026-82690)
Se ha identificado una vulnerabilidad de inyección de comandos del sistema operativo en routers D-Link DNS-327L y DNS-340L hasta la versión 20260717, accesible remotamente a través del parámetro f_dev en /cgi-bin/ve_mgr.cgi. Con puntuación CVSS de 9.1, este defecto permite a atacantes ejecutar comandos arbitrarios sin autenticación. El exploit público amplifica el riesgo para empresas y proveedores de conectividad en Latinoamérica que utilizan estos dispositivos en sus infraestructuras de red.
nvdcriticovulnerabilidad CVSS 9.1 NVD