Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "X" — 10452 resultados ✕ Limpiar búsqueda
14,078
Total alertas
3213
Críticas
10592
Altas
8
Ransomware
1069
Esta semana
RSS
Vulnerabilidades × Limpiar todo ×
M Crítico vulnerabilidad
09/08/2026
[CVE-2026-71989] MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the …
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the porTrigger function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
08/08/2026
[CVE-2026-71983] MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the …
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the wps.cgi interface that allows remote attackers to execute arbitrary commands by injecting malicious input through the pin2g, pin5g, or pin6g parameters. Attackers can exploit these unsanitized parameters to execute arbitrary commands on the affected device and obtain root privileges.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
08/08/2026
[CVE-2026-71956] D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain …
D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands into the netDig.ping.dst field, resulting in command execution with root privileges.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
08/08/2026
[CVE-2026-71957] D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain …
D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A remote attacker can write an overly long string to the netAcc.addlist[].name field and execute arbitrary commands by crafting a specific payload, or cause the device to crash.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
08/08/2026
[CVE-2026-71958] D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain …
D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a specific payload, or cause the device to crash.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
08/08/2026
[CVE-2026-71954] D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c…
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in command execution with root privileges.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
08/08/2026
[CVE-2026-71955] D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain …
D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the /boafrm/formWsc interface. A remote attacker can inject arbitrary malicious commands into the localPin, targetAPSsid, peerPin, and peerRptPin fields, resulting in command execution with root privileges.
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
08/08/2026
[CVE-2026-71948] D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c…
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formDebugDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
08/08/2026
[CVE-2026-71949] D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c…
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in command execution with root privileges.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
08/08/2026
[CVE-2026-71950] D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c…
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the action_value field, resulting in command execution with root privileges.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
08/08/2026
[CVE-2026-71951] D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c…
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEI_value field, resulting in command execution with root privileges.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
08/08/2026
[CVE-2026-71952] D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c…
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPinManageSetup interface. A remote attacker can inject arbitrary malicious commands into the oldPIn field, resulting in command execution with root privileges.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
08/08/2026
[CVE-2026-71953] D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c…
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field, resulting in command execution with root privileges.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
08/08/2026
[CVE-2026-71944] D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c…
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
08/08/2026
[CVE-2026-71945] D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c…
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges.
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
08/08/2026
[CVE-2026-71946] D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c…
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution with root privileges.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
08/08/2026
[CVE-2026-71947] D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c…
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in command execution with root privileges.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
08/08/2026
[CVE-2026-42170] A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. …
A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corrupt…
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
08/08/2026
Inyección de comandos alta en INQUIRELAB mcp-bridge-api (CVE-2026-19263)
Se identificó una vulnerabilidad de inyección de comandos en el componente Servers Endpoint del archivo mcp-bridge.js de INQUIRELAB mcp-bridge-api. Un atacante remoto podría manipular los parámetros command/args para ejecutar comandos arbitrarios en servidores afectados. Esta vulnerabilidad impacta directamente sistemas de integración de APIs en infraestructuras empresariales de México y Latinoamérica que utilizan esta librería en versiones anteriores a b30a82aa1d1d1139e0de846c41c8aadee6e06114.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Crítico vulnerabilidad
08/08/2026
Plugin AI Copilot – Content Generator para WordPress vulnerable a bypass de autorización
El plugin AI Copilot – Content Generator en WordPress (versiones hasta 1.5.6) presenta una vulnerabilidad crítica de bypass de autorización (CVSS 9.8) que permite a atacantes no autenticados crear cuentas de administrador y comprometer completamente el sitio web. Esta vulnerabilidad afecta especialmente a empresas en LATAM que utilizan WordPress para presencia digital y e-commerce.
nvdcriticovulnerabilidad CVSS 9.8 NVD