Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,082
Total alertas
4667
Críticas
16827
Altas
8
Ransomware
1014
Esta semana
RSS
cwe-502 × 30 días × Limpiar todo ×
M Alto vulnerabilidad Nuevo
Hace 3 horas
[CVE-2026-94064] Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme ne…
Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad Nuevo
Hace 3 horas
[CVE-2026-94065] Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Inj…
Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: from n/a through 1.3.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Crítico vulnerabilidad Nuevo
Hace 3 horas
[CVE-2026-100730] A service console interface on openPDC and openHistorian deserializes a client-supplied data structu…
A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated network attacker. This allows an attacker to trigger deserialization of an arbitrary object graph, which c…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad Nuevo
Hace 4 horas
[CVE-2026-104392] Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-ne…
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad Nuevo
Hace 4 horas
[CVE-2026-105872] Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce pr…
Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad Nuevo
Hace 7 horas
[CVE-2026-94568] Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-…
Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.0.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Crítico vulnerabilidad Nuevo
Hace 18 horas
[CVE-2026-88131] Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute …
Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad Nuevo
Hace 20 horas
[CVE-2026-78401] IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 …
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad Nuevo
Hace 20 horas
[CVE-2026-78406] IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 …
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
Hace 1 día
[CVE-2026-105436] Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object In…
Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a through 6.2.1.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Crítico vulnerabilidad
Hace 1 día
[CVE-2026-93034] SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder uncondit…
SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when SGLANG_USE_PICKLE_IPC is disabled, and becomes remotely exploitable if data-parallel attention is enabled wi…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
Hace 1 día
[CVE-2026-82627] The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Inc…
The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object when a third-party integration plu…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Crítico vulnerabilidad
Hace 2 días
[CVE-2026-95606] Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows…
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
Hace 2 días
[CVE-2026-95534] Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Element…
Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Object Injection. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
Hace 2 días
[CVE-2026-106558] Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, t…
Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation source may bypass TechDocs sanitization and cause Python objects to be imported and instantiated in the…
nvdaltovulnerabilidad CVSS 8.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
Hace 2 días
Vulnerabilidad crítica en LMCache: ejecución remota de código en modo distribuido
LMCache en modo distribuido expone un socket ZeroMQ ROUTER sin autenticación que permite a atacantes remotos ejecutar código arbitrario mediante deserialización insegura con pickle. La vulnerabilidad afecta infraestructuras de procesamiento de caché distribuido en centros de datos y servicios en la nube utilizados por empresas en LATAM. Un atacante no autenticado puede registrar procesos maliciosos y comprometer toda la arquitectura de caché compartida.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
Hace 2 días
[CVE-2026-97188] The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserial…
The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and saves that row. If a suitable POP chain is present via another installed String locator WordPress plug…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
Hace 2 días
[CVE-2026-93447] IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and R…
IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized cache value. When the value was retrieved, deserialization could have executed attacker-controlled code with the privileges of the service process.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
Hace 2 días
[CVE-2026-65142] NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untru…
NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Crítico vulnerabilidad
Hace 3 días
[CVE-2026-39797] Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.
Unauthenticated PHP Object Injection in GDPR Framework By Data443
nvdcriticovulnerabilidad CVSS 9.8 NVD