Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,093
Total alertas
4671
Críticas
16834
Altas
8
Ransomware
1012
Esta semana
RSS
cwe-352 × Limpiar todo ×
M Alto vulnerabilidad
04/07/2026
[CVE-2026-12740] Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter…
Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter. RequestTokenV2 builds the provider authorization redirect without issuing a state value, and AccessTokenV2 exchanges the callback code and registers the resulting token into the session (register_session) without verifying that the callback corresponds to an authorization request this session ini…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
04/07/2026
[CVE-2026-12746] Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 st…
Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter. The authentication_url method builds the provider authorization redirect without issuing a state value, and the callback method exchanges the callback code and registers the resulting token into the session without verifying that the callback corresponds to an authorization request t…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
02/07/2026
[CVE-2026-57761] Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP <= 3.12.2 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
02/07/2026
[CVE-2026-57766] Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor <= 3.5.6 ver…
Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
02/07/2026
[CVE-2026-57757] Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
02/07/2026
[CVE-2026-57758] Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce <= 1.0.8.2 ve…
Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
02/07/2026
[CVE-2026-57759] Unauthenticated Cross Site Request Forgery (CSRF) in ProfileGrid <= 5.9.9.7 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in ProfileGrid
nvdaltovulnerabilidad CVSS 8.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
02/07/2026
[CVE-2026-57751] Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login <= 1.1.39 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
01/07/2026
[CVE-2026-57723] Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS al…
Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Path Traversal. This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.12.
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
01/07/2026
[CVE-2026-12158] The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-S…
The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0.9.1. This is due to missing or incorrect nonce validation on the process_request function. This makes it possible for unauthenticated attackers to escalate the privileges of an arbitrary form submitter to administrator by creating a malic…
nvdaltovulnerabilidad CVSS 8.8 NVD
A Alto vulnerabilidad
29/06/2026
[CVE-2026-43735] The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and i…
The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may exfiltrate data cross-origin.
nvdaltovulnerabilidad CVSS 8.1 NVD
B Alto vulnerabilidad
26/06/2026
[CVE-2026-50132] Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token…
Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token/handoff` is a public endpoint (no auth required) that performs a permanent, state-changing operation: it binds an external chat identity (Slack/Discord/MS Teams) to an authenticated Budibase user account, with no consent UI and no CSRF protection. The session token in the URL is created by the atta…
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-52784] OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there…
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a CSRF on TARGET through /users/:id via POST parameter "user[admin]". This vulnerability is fixed in 17.3.3 and 17.4.1.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-57659] Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <=…
Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
26/06/2026
[CVE-2026-57655] Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard
nvdaltovulnerabilidad CVSS 8.2 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
26/06/2026
[CVE-2025-68052] Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
24/06/2026
[CVE-2026-52800] Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization team member management…
Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization team member management can be performed via GET requests without CSRF protection. If a victim who is an organization owner is logged in and is tricked into visiting a crafted link, an attacker-controlled user can be added to the Owners team. As a result, the attacker gains organization owner–equivalent privileges. This v…
nvdaltovulnerabilidad CVSS 8.8 NVD
A Crítico vulnerabilidad
19/06/2026
[CVE-2026-49871] Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations.…
Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. This defect allows a remote attacker that manages to send a victim to a webpage controlled by them can cause the victim's browser to become authenticated as a different identity. Actions the victim takes upstream are then attributed to attackers identity. This issue affects Apache APISIX: from …
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
18/06/2026
[CVE-2026-55742] Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the ad…
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg() to validate the anti-CSRF token. A remote attacker who lures an authenticated administrator into visitin…
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Alto vulnerabilidad
18/06/2026
[CVE-2026-55744] Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Pe…
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.main.php, the file upload action ('a=upload') processes uploaded files without calling cot_check_xg() to validate the anti-CSRF token, even though sibling actions such as 'delete' (line 272) do. A remote attacker who lures an authenticated use…
nvdaltovulnerabilidad CVSS 8.1 NVD