Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 44 min
26,055
Total alertas
5224
Críticas
19974
Altas
8
Ransomware
1856
Esta semana
RSS
M Alto vulnerabilidad
28/08/2026
[CVE-2026-27852] An attacker that can send mail to a user can craft a message whose headers contain a very large numb…
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. Update to non-vulner…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-33605] An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed com…
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode (default for community releases), only the attacker's own connection is terminated. If running in high-performance mode (default for Pro releases), all connections handled by the same managesieve-login process are terminated. Repeating the…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-79996] The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability chec…
The User Registration & Membership WordPress plugin before 5.2.6 does not perform a capability check when saving its login settings, allowing authenticated users who have been granted a User Registration & Membership WordPress plugin before 5.2.6 management capability but not full administrator access to change arbitrary site options and escalate their privileges to administrator.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-5097] The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in …
The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in all versions up to, and including, 2.4.17. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-6286] The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stor…
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification (Command.php line 186), allowing unauthenticated users to submit booking data. While the plugin applies saniti…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Crítico vulnerabilidad
28/08/2026
[CVE-2026-76581] The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions u…
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` AJAX actions, where step 1 signs and discloses an unseparated concatenation of the token, state, redirect, and domain values, while step 2 ver…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
28/08/2026
[CVE-2026-78032] SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed…
SOY CMS contains an issue with deserialization of untrusted data. An arbitrary code may be executed by an attacker with the web server privilege.
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
28/08/2026
[CVE-2026-40541] An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilit…
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM.
nvdcriticovulnerabilidad CVSS 9.0 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-14558] The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions …
The User Frontend WordPress plugin before 4.3.10 does not properly validate field type definitions and deserialises user-controlled post metadata when rendering submitted posts, allowing users with Editor-level access and above to inject arbitrary PHP objects, which can lead to remote code execution when a suitable POP chain is present on the site.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-19084] The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when cr…
The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-19423] The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection whe…
The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list, allowing unauthenticated users who register through the Ultimate Member WordPress plugin before 2.13.0's own form to grant thems…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
28/08/2026
CVE-2026-70331 Microsoft Edge for iOS Spoofing Vulnerability
Microsoft publica advisory de seguridad: CVE-2026-70331 Microsoft Edge for iOS Spoofing Vulnerability. Tipo: Suplantación (Spoofing).
edgespoofing Microsoft MSRC
M Medio vulnerabilidad
28/08/2026
CVE-2026-58616 Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability
Microsoft publica advisory de seguridad: CVE-2026-58616 Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability. Tipo: Divulgación de Información.
edgeinfo-disclosure Microsoft MSRC
G Medio vulnerabilidad
28/08/2026
CVE-2026-62904 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Microsoft publica advisory de seguridad: CVE-2026-62904 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability. Tipo: Divulgación de Información.
edgeinfo-disclosure Microsoft MSRC
G Crítico vulnerabilidad
28/08/2026
CVE-2026-66323 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Microsoft publica advisory de seguridad: CVE-2026-66323 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).
edgerce Microsoft MSRC

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
G Alto vulnerabilidad
28/08/2026
CVE-2026-66324 Microsoft Edge (Chromium-based) Spoofing Vulnerability
Microsoft publica advisory de seguridad: CVE-2026-66324 Microsoft Edge (Chromium-based) Spoofing Vulnerability. Tipo: Suplantación (Spoofing).
edgespoofing Microsoft MSRC
G Crítico vulnerabilidad
28/08/2026
CVE-2026-66798 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Microsoft publica advisory de seguridad: CVE-2026-66798 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).
edgerce Microsoft MSRC
G Crítico vulnerabilidad
28/08/2026
CVE-2026-70341 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Microsoft publica advisory de seguridad: CVE-2026-70341 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).
edgerce Microsoft MSRC
G Medio vulnerabilidad
28/08/2026
Chromium: CVE-2026-78892 Incorrect authorization in Chromoting
Microsoft publica advisory de seguridad: Chromium: CVE-2026-78892 Incorrect authorization in Chromoting.
Microsoft MSRC
G Medio vulnerabilidad
28/08/2026
Chromium: CVE-2026-78893 Information leak in QUIC
Microsoft publica advisory de seguridad: Chromium: CVE-2026-78893 Information leak in QUIC.
Microsoft MSRC