Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Hace 1 hora

[CVE-2026-71925] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail funct…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for t…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 1 hora

[CVE-2026-71926] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice funct…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the username, password, and location fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative cre…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 1 hora

[CVE-2026-71917] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace funct…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web m…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 1 hora

[CVE-2026-71918] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filtering of the option, key, pw_encode, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid admini…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 1 hora

[CVE-2026-71919] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot funct…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerability is caused by insufficient filtering of the config, act, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credenti…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 1 hora

[CVE-2026-71912] Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. …

Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing length checks during memory copy operations involving the CMD6 field. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credent…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 1 hora

[CVE-2026-71913] Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative creden…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 1 hora

[CVE-2026-71915] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus func…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credent…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 1 hora

[CVE-2026-71906] Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. Th…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the devi…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 1 hora

[CVE-2026-71907] Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function.…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's we…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 1 hora

[CVE-2026-71908] Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_te…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is caused by insufficient sanitization of the meshdevice_index and meshdevice_ip fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administ…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 1 hora

[CVE-2026-71909] Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime functio…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web mana…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 1 hora

[CVE-2026-71910] Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 1 hora

[CVE-2026-71911] Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The …

Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The vulnerability is caused by missing length checks during memory copy operations involving the lanVlanId0, lanIp, and lanNetmask fields. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires va…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 1 hora

[CVE-2026-71905] Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings func…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the backupkey, backuptype, and realtime fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative cr…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad Nuevo

Hace 2 horas

[CVE-2026-77915] rConfig 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthentica…

rConfig 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad Nuevo

Hace 3 horas

[CVE-2026-71364] A path traversal vulnerability was found in AWX's project archive extraction. The project_archive ac…

A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory traversal sequences. A malicious archive containing members with path traversal components can write file…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 3 horas

[CVE-2026-71366] A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. …

A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, or reserved IP ranges. An organization notification administrator can create notification templates p…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad Nuevo

Hace 3 horas

[CVE-2025-68825] HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lat…

HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad Nuevo

Hace 4 horas

[CVE-2026-78414] Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before vers…

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session token, resulting in Administrator Account Takeover. An attacker who controls an Nx server on the same netwo…

nvdaltovulnerabilidad CVSS 8.0 NVD