Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,599
Total alertas
3086
Críticas
10241
Altas
8
Ransomware
1805
Esta semana
RSS
M Alto vulnerabilidad
09/06/2026
[CVE-2026-36794] Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain…
Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain multiple stack overflows in the R7WebsSecurityHandler function via the username and password parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
09/06/2026
[CVE-2026-36727] An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3 allows…
An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Alto vulnerabilidad
09/06/2026
[CVE-2026-36770] Shenzhen Tenda Technology Co., Ltd Tenda US_W3V1.0BR v1.0.0.3 was discovered to contain a stack over…
Shenzhen Tenda Technology Co., Ltd Tenda US_W3V1.0BR v1.0.0.3 was discovered to contain a stack overflow in the Go parameter of the ask_to_reboot function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
09/06/2026
[CVE-2026-36771] Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain…
Shenzhen Tenda Technology Co., Ltd Tenda W3 Wireless Router v1.0.0.3(2204) was discovered to contain a stack overflow in the wl_radio parameter of the formwrlSSIDset function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
09/06/2026
[CVE-2026-36719] An information disclosure vulnerability in the /api/v1/user/info endpoint of AgentChat v2.3.0 allows…
An information disclosure vulnerability in the /api/v1/user/info endpoint of AgentChat v2.3.0 allows unauthenticated attackers to obtain sensitive information, including SHA256 password hashes, via enumerating user IDs.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
09/06/2026
[CVE-2026-36720] Insecure permissions in bookcars v8.3 allows authenticated attackers to escalate privileges from use…
Insecure permissions in bookcars v8.3 allows authenticated attackers to escalate privileges from user to admin via modifying their user type.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Crítico vulnerabilidad
09/06/2026
[CVE-2026-36721] A lack of cryptographic signature verification in the validateAccessToken function of bookcars v8.3 …
A lack of cryptographic signature verification in the validateAccessToken function of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token.
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
09/06/2026
[CVE-2026-36723] An unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3 allows …
An unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3 allows authenticated attackers to leverage directory traversal sequences to move arbitrary files from temporary storage to arbitrary locations on the server filesystem. This enables unauthorized access to sensitive files, the overwriting of critical application files, and remote code execution (RCE).
nvdaltovulnerabilidad CVSS 8.8 NVD
M Crítico vulnerabilidad
09/06/2026
[CVE-2026-30141] An issue was discovered in bitbank2 AnimatedGIF v2.2.0. A buffer overflow in the DecodeLZW function …
An issue was discovered in bitbank2 AnimatedGIF v2.2.0. A buffer overflow in the DecodeLZW function allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via a crafted GIF file.
nvdcriticovulnerabilidad CVSS 9.8 NVD
G Alto vulnerabilidad
09/06/2026
[CVE-2025-52292] A stack buffer overflow in the filein_process function (in_file.c) of GPAC MP4Box v2.4 allows attack…
A stack buffer overflow in the filein_process function (in_file.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
nvdaltovulnerabilidad CVSS 7.5 NVD
G Alto vulnerabilidad
09/06/2026
[CVE-2025-52293] A segmentation violaton in the gf_hevc_read_sps_bs_internal function (media_tools/av_parsers.c) of G…
A segmentation violaton in the gf_hevc_read_sps_bs_internal function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying crafted HEVC SPS data.
nvdaltovulnerabilidad CVSS 7.5 NVD
G Alto vulnerabilidad
09/06/2026
[CVE-2025-55657] A NULL pointer dereference in the gf_odf_vvc_cfg_write_bs function (odf/descriptors.c) of GPAC MP4Bo…
A NULL pointer dereference in the gf_odf_vvc_cfg_write_bs function (odf/descriptors.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
09/06/2026
[CVE-2026-10045] Shenzhen Kangda Xin Intelligent Network Technology Company's router, model DR300, version 2.1.2.121,…
Shenzhen Kangda Xin Intelligent Network Technology Company's router, model DR300, version 2.1.2.121, contains hardcoded login credentials and has telnet enabled by default on WAN and LAN interfaces. These vulnerabilities allow attackers to read and write to memory, modify firmware stored in flash, inspect active connections, and view currently connected devices.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
09/06/2026
[CVE-2023-43688] An issue was discovered in Malwarebytes 4.x and 5.x (and Nebula 2020-10-21 and later). There is a He…
An issue was discovered in Malwarebytes 4.x and 5.x (and Nebula 2020-10-21 and later). There is a Heap buffer overflow in various buffer encryption utilities.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
09/06/2026
[CVE-2023-29146] The utility functions used by Malwarebytes EDR 1.0.11 on Linux for calculating a cryptographic hash …
The utility functions used by Malwarebytes EDR 1.0.11 on Linux for calculating a cryptographic hash of data bytes truncate the hashed data if it exceeds 4GB. This leads to an integer wrap-around if the data is larger than the maximum unsigned integer value (32-bit). Attackers could create a colliding hash value for two different strings by attaching 4GB of data to a string that is less than 4GB in…
nvdaltovulnerabilidad CVSS 8.2 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
09/06/2026
[CVE-2026-50635] LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without…
LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHosts allowlist that would constrain this is undefined in the default (and documented) configuration, so LSHttpRequest::checkIsAllowedHost() results in no operation. A remote, unauthenticated attacker who submits a forgotten-password request for a known account (r…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
09/06/2026
[CVE-2026-50636] The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied tok…
The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied token-ID array into TokenDynamic::findUninvited(), which concatenates the values directly into a tid IN ('...') SQL clause without parameterization or input validation. A remote, authenticated attacker holding the tokens/update permission on a survey can inject a crafted array element to perform SQL in…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
09/06/2026
[CVE-2026-50512] Missing authentication for critical function in Microsoft PC Manager allows an authorized attacker t…
Missing authentication for critical function in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
09/06/2026
[CVE-2026-50511] Improper link resolution before file access ('link following') in Microsoft PC Manager allows an aut…
Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.
nvdaltovulnerabilidad CVSS 7.8 NVD
A Alto vulnerabilidad
09/06/2026
[CVE-2026-48293] InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by an out-of-bounds write vulnerabil…
InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
nvdaltovulnerabilidad CVSS 7.8 NVD