Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,113
Total alertas
4677
Críticas
16848
Altas
8
Ransomware
1019
Esta semana
RSS
cwe-78 × 30 días × Limpiar todo ×
M Alto vulnerabilidad
22/09/2026
[CVE-2026-16468] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute a…
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
22/09/2026
[CVE-2026-16469] IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker t…
IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
22/09/2026
[CVE-2026-17102] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute a…
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
22/09/2026
[CVE-2026-76714] Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users…
Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Crítico vulnerabilidad
22/09/2026
[CVE-2026-43641] Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerabil…
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can deserialize a crafted billing_data POST field and inject shell payloads through the uid field, which…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
22/09/2026
[CVE-2026-80151] Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmwa…
Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set nfs download command that passes unsanitized user input to a system() call. Attackers wit…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
22/09/2026
[CVE-2026-80152] Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmwa…
Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set script schedule command that passes unsanitized user input to a system() call. Attackers …
nvdcriticovulnerabilidad CVSS 9.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
22/09/2026
[CVE-2026-80145] Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmwa…
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set cifs password command that passes unsanitized user input to a system() call. Attackers wi…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
22/09/2026
[CVE-2026-80144] Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmwa…
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom write command that passes unsanitized user input to a system() call. Attackers can authenticate as …
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
22/09/2026
[CVE-2026-80143] Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmwa…
Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom read command that passes unsanitized user input to a system() call. Attackers can authenticate as a…
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Alto vulnerabilidad
22/09/2026
[CVE-2026-65130] NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS…
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.
nvdaltovulnerabilidad CVSS 8.0 NVD
M Crítico vulnerabilidad
22/09/2026
[CVE-2026-95675] D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution …
D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted requests to the device's web management interface without valid credentials. Attackers can fully compromise the device to persistently modify its configuration and use it as a pivot point into the loc…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
22/09/2026
Vulnerabilidad crítica de ejecución remota de código en Zohocorp ManageEngine ADSelfService Plus (CVE-2026-74849)
Zohocorp ManageEngine ADSelfService Plus en versiones anteriores a la build 7001 presenta una vulnerabilidad de ejecución remota de código (RCE) con CVSS 9.8 en el cliente GINA. Esta falla permite a atacantes ejecutar comandos arbitrarios sin autenticación previa, afectando principalmente a empresas en LATAM que utilizan esta solución para gestión de identidades y acceso en entornos Active Directory. El impacto es crítico en infraestructuras de TI medianas y grandes.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
21/09/2026
[CVE-2026-79916] MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace me…
MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock access_key_id and secret_access_key fields that _update_aws_credentials writes to /root/.aws/credentials without safe parsing. An attacker can append a new AWS profile containing credential_process, then select that profile during a later model-va…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
21/09/2026
[CVE-2026-77521] MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a …
MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on, so human approval is not required. Untrusted chat or ingested content can therefore cause command execution; source deployments with MAXKB_…
nvdcriticovulnerabilidad CVSS 10.0 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
21/09/2026
[CVE-2026-55897] luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to r…
luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json grants rpcd file.exec permission f…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
21/09/2026
[CVE-2026-62182] KubeEdge is an open source system for extending native containerized application orchestration capab…
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled updateFields values into the keadm config-update command and executes it through a system shell. A user wit…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
21/09/2026
[CVE-2026-62371] KubeEdge is an open source system for extending native containerized application orchestration capab…
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated user-controlled spec.version and spec.image values into the keadm upgrade edge shell command. A user with permissio…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
21/09/2026
[CVE-2026-82412] ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability…
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept the scan_ports parameter without an administrator gate and pass it through validateSingleWord, which permits shell metacharacters. scripts/lua/modules/vulnerability_scan/…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
21/09/2026
[CVE-2026-84285] An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 cou…
An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the server.
nvdaltovulnerabilidad CVSS 8.8 NVD