Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

22,082

Total alertas

4667

Críticas

16827

Altas

8

Ransomware

1012

Esta semana

RSS

cwe-640 × Limpiar todo ×

M Crítico vulnerabilidad

[CVE-2026-107640] Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/use…

Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty reset_key matches the defaulted empty value, to take over administrator accounts after enumerating valid usernames.

M Crítico vulnerabilidad

[CVE-2026-19218] Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN Software Computer Impo…

Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta allows Password Recovery Exploitation. This issue affects MyRezzta: from 2.06.03 before 2.07.01.

M Crítico vulnerabilidad

[CVE-2026-53953] GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of…

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary password and immediately stores its hash as the user's new password. The temporary password is generated…

M Crítico vulnerabilidad

[CVE-2026-102115] Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An u…

Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges.

M Alto vulnerabilidad

[CVE-2026-101188] A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects …

A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects the function routerd.passwd_set of the file /ubus. Such manipulation leads to weak password recovery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

M Alto vulnerabilidad

[CVE-2026-100870] Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-res…

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for known administrator email addresses with forged Host headers to intercept valid reset tokens and take over …

M Alto vulnerabilidad

[CVE-2026-93453] SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the a…

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid password-reset tokens mailed to victim recovery addresses within links pointing to attacker infrastruc…

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Alto vulnerabilidad

[CVE-2026-90522] A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b…

A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass of the file UsersController.java of the component Password Recovery. This manipulation causes weak password recovery. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with …

M Alto vulnerabilidad

[CVE-2026-6285] Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref Innovation and Tech…

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Password Recovery Exploitation. This issue affects LIBRID/LIBREF: from 2.01.0.2183 through 10092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

M Crítico vulnerabilidad

[CVE-2026-84699] Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local ac…

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access.

M Alto vulnerabilidad

[CVE-2026-80196] Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remai…

Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional times within a 1-hour window to log in as the user even after the legitimate user has changed their pass…

M Crítico vulnerabilidad

[CVE-2026-19632] The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulner…

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL — including the plaintext reset key and login parameters sto…

M Crítico vulnerabilidad

Vulnerabilidad crítica de autenticación en plugins de WordPress para WooCommerce (CVE-2026-77264)

El plugin 'Automation Web Platform – Notifications and OTP for WooCommerce' y el complemento 'Advanced Country Code' para WordPress presentan un bypass de autenticación en versiones hasta 4.8.6. La función handle_email_otp_return() expone el token de login secreto en respuestas públicas de solicitudes OTP, permitiendo acceso no autorizado sin validación de correo. Afecta directamente a tiendas en línea, plataformas de e-commerce y sitios con autenticación de dos factores basada en OTP en México y Latinoamérica.

M Crítico vulnerabilidad

[CVE-2026-18963] A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core…

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user …

M Crítico vulnerabilidad

[CVE-2026-12949] The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verifica…

The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpm_register() function validating the registration cookie only against the GET reg parameter while accepting the POST mergewith and POST wpm_id parameters without verifying that the mergewith user ID references a t…

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Alto vulnerabilidad

[CVE-2026-72856] Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/globa…

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On self-hosted instances (SELF_HOSTED or DISABLE_ACCOUNT_PORTAL set), the cloudRestricted middleware is a no-op and the route is protected only by a general authentication check, so any authenticated user — including a lowest-privilege BASIC ap…

M Crítico vulnerabilidad

[CVE-2026-66691] Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.

Unauthenticated Broken Access Control in Nokri

M Crítico vulnerabilidad

[CVE-2026-61967] Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.

Unauthenticated Privilege Escalation in miniorange otp verification

M Crítico vulnerabilidad

[CVE-2026-12571] An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeov…

An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.

M Crítico vulnerabilidad

Vulnerabilidad crítica de takeover de cuentas en plugin TrueBooker para WordPress (CVE-2026-14364)

El plugin TrueBooker para WordPress (versiones hasta 1.2.3) permite a atacantes no autenticados resetear contraseñas de usuarios arbitrarios mediante validación insuficiente de identidad. Afecta directamente a sitios de servicios (salones, clínicas, agencias) en LATAM que usan este plugin para reservas. Un atacante podría acceder a cuentas administrativas y comprometer datos de clientes.

1 2 3 Siguiente →