Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,509
Total alertas
3066
Críticas
10171
Altas
8
Ransomware
1799
Esta semana
RSS
7 días × Limpiar todo ×
M Alto vulnerabilidad
Hace 5 días
[CVE-2026-73342] Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Multilang
nvdaltovulnerabilidad CVSS 7.1 NVD
M Crítico vulnerabilidad
Hace 5 días
[CVE-2026-73343] Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Alto vulnerabilidad
Hace 5 días
[CVE-2026-73181] Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 ver…
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
Hace 5 días
[CVE-2026-73187] Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.
Unauthenticated SQL Injection in Sticky Chat Widget
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Alto vulnerabilidad
Hace 5 días
[CVE-2026-66793] A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Man…
A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-admin privileges on the managed cluster, leading to arbitrary code execution and …
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
Hace 5 días
[CVE-2026-68567] Unauthenticated Cross Site Scripting (XSS) in Convert Pro <= 1.0.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Convert Pro
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
Hace 5 días
[CVE-2026-69189] Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.use…
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history ide…
nvdaltovulnerabilidad CVSS 7.6 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
Hace 5 días
[CVE-2026-66667] Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Templately
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
Hace 5 días
[CVE-2026-66635] Unauthenticated Cross Site Request Forgery (CSRF) in Slider by 10Web <= 1.2.62 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in Slider by 10Web
nvdaltovulnerabilidad CVSS 7.4 NVD
M Alto vulnerabilidad
Hace 5 días
[CVE-2026-66046] Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic compl…
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes …
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
Hace 5 días
[CVE-2026-66620] Editor PHP Object Injection in OptionTree <= 2.7.3 versions.
Editor PHP Object Injection in OptionTree
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
Hace 5 días
[CVE-2026-66621] Unauthenticated Cross Site Scripting (XSS) in Ultimate Dashboard <= 3.11.2 versions.
Unauthenticated Cross Site Scripting (XSS) in Ultimate Dashboard
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
Hace 5 días
[CVE-2026-66622] Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions.
Unauthenticated SQL Injection in Depicter Slider
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
Hace 5 días
[CVE-2026-66627] Contributor Arbitrary File Upload in GP Premium <= 2.5.5 versions.
Contributor Arbitrary File Upload in GP Premium
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Alto vulnerabilidad
Hace 5 días
[CVE-2026-66629] Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Kirki
nvdaltovulnerabilidad CVSS 7.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
Hace 5 días
[CVE-2026-66633] Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.
Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Crítico vulnerabilidad
Hace 5 días
[CVE-2026-59940] Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify cap…
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potenti…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
Hace 5 días
[CVE-2026-61407] Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Acce…
Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
Hace 5 días
[CVE-2026-63639] Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey…
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote …
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
Hace 5 días
[CVE-2026-56684] Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey…
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This …
nvdaltovulnerabilidad CVSS 7.5 NVD