Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
26,055
Total alertas
5224
Críticas
19974
Altas
8
Ransomware
2017
Esta semana
RSS
G Medio vulnerabilidad
28/08/2026
Chromium: CVE-2026-79098 UI misrepresentation in PermissionElement
Microsoft publica advisory de seguridad: Chromium: CVE-2026-79098 UI misrepresentation in PermissionElement.
Microsoft MSRC
G Medio vulnerabilidad
28/08/2026
Chromium: CVE-2026-79099 Missing authorization in Network
Microsoft publica advisory de seguridad: Chromium: CVE-2026-79099 Missing authorization in Network.
Microsoft MSRC
G Medio vulnerabilidad
28/08/2026
Chromium: CVE-2026-79103 Incorrect reference resolution in Speech
Microsoft publica advisory de seguridad: Chromium: CVE-2026-79103 Incorrect reference resolution in Speech.
Microsoft MSRC
G Medio vulnerabilidad
28/08/2026
Chromium: CVE-2026-79104 Missing authorization in Sensor
Microsoft publica advisory de seguridad: Chromium: CVE-2026-79104 Missing authorization in Sensor.
Microsoft MSRC
G Medio vulnerabilidad
28/08/2026
Chromium: CVE-2026-79106 Improper input validation in Input
Microsoft publica advisory de seguridad: Chromium: CVE-2026-79106 Improper input validation in Input.
Microsoft MSRC
G Medio vulnerabilidad
28/08/2026
Chromium: CVE-2026-79107 Incorrect authorization in TabGroups
Microsoft publica advisory de seguridad: Chromium: CVE-2026-79107 Incorrect authorization in TabGroups.
Microsoft MSRC
G Medio vulnerabilidad
28/08/2026
Chromium: CVE-2026-79108 UI misrepresentation in Web Authentication (Passkeys & Security Keys)
Microsoft publica advisory de seguridad: Chromium: CVE-2026-79108 UI misrepresentation in Web Authentication (Passkeys & Security Keys).
Microsoft MSRC

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
G Medio vulnerabilidad
28/08/2026
Chromium: CVE-2026-79110 Missing authorization in Preload
Microsoft publica advisory de seguridad: Chromium: CVE-2026-79110 Missing authorization in Preload.
Microsoft MSRC
G Medio vulnerabilidad
28/08/2026
Chromium: CVE-2026-79112 Out of bounds read in Skia
Microsoft publica advisory de seguridad: Chromium: CVE-2026-79112 Out of bounds read in Skia.
Microsoft MSRC
G Medio vulnerabilidad
28/08/2026
Chromium: CVE-2026-79116 Missing authorization in Viz
Microsoft publica advisory de seguridad: Chromium: CVE-2026-79116 Missing authorization in Viz.
Microsoft MSRC
M Crítico vulnerabilidad
28/08/2026
[CVE-2026-82082] NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remot…
NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-76053] The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulner…
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-77365] The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin f…
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' (above_fold_images) parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages t…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-18983] The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site S…
The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpua_action_process_option_update function. This is due to insufficient file type validation in wp_handle_upload() called without a MIME allow-list, with post-write validation relying on the attacker-controlled client-supplied Content-Type…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-18324] The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vuln…
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a use…
nvdaltovulnerabilidad CVSS 7.2 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
28/08/2026
[CVE-2026-18978] The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Co…
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A comment payload crafted exclusive…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-38820] openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injec…
openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /opennds_preauth/ endpoint because of libopennds.sh.
nvdaltovulnerabilidad CVSS 8.3 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-38821] A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenti…
A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon (denial of service) and potentially achieve remote code execution. This is in http_microhttpd.c.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-38822] In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the au…
In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.
nvdaltovulnerabilidad CVSS 7.6 NVD
M Crítico vulnerabilidad
28/08/2026
[CVE-2026-61800] Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints an…
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code execution as root. During cluster file synchronization, the non-merged branch of update_master_files_in_worker…
nvdcriticovulnerabilidad CVSS 9.1 NVD