Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Multiple Vendors" — 18620 resultados ✕ Limpiar búsqueda
24,154
Total alertas
4942
Críticas
18545
Altas
8
Ransomware
2477
Esta semana
RSS
M Alto vulnerabilidad
16/06/2026
[CVE-2026-42089] Yeoman Environment provides an API to discover, create, and run generators, and to configure where a…
Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass attacker-controlled project configuration into this path, this can result in arbitrary package install…
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
16/06/2026
[CVE-2026-44932] Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 co…
Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
16/06/2026
[CVE-2025-71261] An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE H…
An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it to bypass TLS as a security control.
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
16/06/2026
[CVE-2026-10649] A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vu…
A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing.
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
16/06/2026
[CVE-2024-24909] Dell OpenManage Integration with Microsoft Windows Admin Center contains a Remote Code Execution vul…
Dell OpenManage Integration with Microsoft Windows Admin Center contains a Remote Code Execution vulnerability in the gateway plugin. A remote authenticated user could potentially exploit this vulnerability to escalate privileges. The malicious user may gain the ability to run arbitrary code remotely. This is a high severity vulnerability so Dell recommends customers to upgrade at the earliest opp…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
16/06/2026
[CVE-2024-38487] api-gateway container running with root privilege would allow an attacker to escape the container an…
api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintended actions.
nvdaltovulnerabilidad CVSS 7.0 NVD
M Alto vulnerabilidad
16/06/2026
[CVE-2026-47684] Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and synci…
Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.3.0, the private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1), allowing SSRF protection to be bypassed on dual-stack systems. Version 2.3.0 fixes the issue.
nvdaltovulnerabilidad CVSS 7.7 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
16/06/2026
[CVE-2026-48780] Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously craft…
Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of `a2ab6d4`. As a workaround, some SMTP servers and email delivery providers may drop or refuse to send maliciously crafted email ad…
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
16/06/2026
[CVE-2026-12398] A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the lega…
A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the legacy role import API (v1) interpolates unsanitized git ref names (branch/tag names) into shell commands executed via subprocess.run() with shell=True. An authenticated user who controls a git repository can create a branch or tag with shell metacharacters in the name to achieve remote code execution o…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
16/06/2026
[CVE-2026-40750] Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store al…
Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Shell to a Web Server. This issue affects Kids Online Store: from n/a through 0.8.9.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Alto vulnerabilidad
16/06/2026
[CVE-2026-8442] The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions u…
The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8. This is due to missing authorization checks on the wpfb_hide_review and wprp_save_review_admin AJAX handlers combined with insufficient path validation in the wpfb_hidereview_ajax() function, which uses strpos() to check that a stored media URL starts with the expected pre…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Crítico vulnerabilidad
16/06/2026
[CVE-2026-52715] Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.
Unauthenticated SQL Injection in GEO my WordPress
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Alto vulnerabilidad
16/06/2026
[CVE-2026-54191] Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions.
Unauthenticated Cross Site Scripting (XSS) in Pods
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
16/06/2026
[CVE-2026-54198] Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions.
Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
16/06/2026
[CVE-2026-5416] Due to the improper neutralization of special elements used in a name parameter a low privileged rem…
Due to the improper neutralization of special elements used in a name parameter a low privileged remote attacker can exploit a command injection vulnerability in the Managed Ethernet Switch, resulting in full system compromise.
nvdaltovulnerabilidad CVSS 8.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
16/06/2026
[CVE-2026-8176] The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerab…
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1. The plugin chains three independent flaws that together allow an authenticated Agent (Agent+) to overwrite a WordPress Administrator's password without ever invoking an Administrator-only API. This makes it possible…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
16/06/2026
[CVE-2026-39490] Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.
Unauthenticated Broken Access Control in JupiterX Core
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
16/06/2026
[CVE-2026-39574] Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.
Unauthenticated SQL Injection in InPost Gallery
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Alto vulnerabilidad
16/06/2026
[CVE-2026-39581] Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions.
Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic
nvdaltovulnerabilidad CVSS 8.5 NVD
M Crítico vulnerabilidad
16/06/2026
[CVE-2026-49772] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2.
nvdcriticovulnerabilidad CVSS 9.3 NVD