Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71926] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice funct…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the username, password, and location fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative cre…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71917] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace funct…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web m…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71918] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filtering of the option, key, pw_encode, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid admini…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71919] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot funct…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerability is caused by insufficient filtering of the config, act, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credenti…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71912] Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. …

Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing length checks during memory copy operations involving the CMD6 field. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credent…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71913] Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative creden…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71915] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus func…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credent…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71916] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the commandTable fu…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the commandTable function. The vulnerability is caused by incomplete filtering of dangerous characters such as backticks, newline characters, and single quotes in the parameter field. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation req…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71906] Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. Th…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the devi…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71907] Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function.…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's we…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71908] Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_te…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is caused by insufficient sanitization of the meshdevice_index and meshdevice_ip fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administ…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71909] Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime functio…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web mana…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71910] Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71911] Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The …

Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The vulnerability is caused by missing length checks during memory copy operations involving the lanVlanId0, lanIp, and lanNetmask fields. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires va…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71904] Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform fun…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the event_code field is concatenated into a system command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid a…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71905] Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings func…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the backupkey, backuptype, and realtime fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative cr…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-78465] A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX…

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersize…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2025-36940] Use-After-Free vulnerability in a zircon kernel pager proxy (Fuchsia), which could lead to a Privile…

Use-After-Free vulnerability in a zircon kernel pager proxy (Fuchsia), which could lead to a Privilege Escalation from Userspace to Kernel (AP)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71364] A path traversal vulnerability was found in AWX's project archive extraction. The project_archive ac…

A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory traversal sequences. A malicious archive containing members with path traversal components can write file…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71366] A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. …

A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, or reserved IP ranges. An organization notification administrator can create notification templates p…

nvdaltovulnerabilidad CVSS 7.7 NVD