Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Ni" — 7567 resultados ✕ Limpiar búsqueda
22,841
Total alertas
4833
Críticas
17354
Altas
8
Ransomware
1408
Esta semana
RSS
M Alto vulnerabilidad
24/08/2026
[CVE-2026-71924] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function…
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the …
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
24/08/2026
[CVE-2026-71925] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail funct…
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for t…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
24/08/2026
[CVE-2026-71926] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice funct…
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the username, password, and location fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative cre…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
24/08/2026
[CVE-2026-71917] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace funct…
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web m…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
24/08/2026
[CVE-2026-71918] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction…
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filtering of the option, key, pw_encode, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid admini…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
24/08/2026
[CVE-2026-71919] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot funct…
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerability is caused by insufficient filtering of the config, act, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credenti…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
24/08/2026
[CVE-2026-71912] Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. …
Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing length checks during memory copy operations involving the CMD6 field. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credent…
nvdaltovulnerabilidad CVSS 7.2 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
24/08/2026
[CVE-2026-71913] Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi…
Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative creden…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
24/08/2026
[CVE-2026-71915] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus func…
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credent…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
24/08/2026
[CVE-2026-71906] Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. Th…
Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the devi…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
24/08/2026
[CVE-2026-71907] Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function.…
Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's we…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
24/08/2026
[CVE-2026-71908] Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_te…
Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is caused by insufficient sanitization of the meshdevice_index and meshdevice_ip fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administ…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
24/08/2026
[CVE-2026-71909] Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime functio…
Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web mana…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
24/08/2026
[CVE-2026-71910] Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function…
Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the …
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
24/08/2026
[CVE-2026-71911] Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The …
Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The vulnerability is caused by missing length checks during memory copy operations involving the lanVlanId0, lanIp, and lanNetmask fields. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires va…
nvdaltovulnerabilidad CVSS 7.2 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
24/08/2026
[CVE-2026-71905] Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings func…
Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the backupkey, backuptype, and realtime fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative cr…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Crítico vulnerabilidad
24/08/2026
[CVE-2026-77915] rConfig 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthentica…
rConfig 8.0.0 before 8.2.13 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accounts with full Administrator privileges due to a duplicate bare Auth::routes() call in routes/web.php that re-enables the POST /register route after it was explicitly disabled. Attackers can register a new account that is immediately authenticated with Admin-level …
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
24/08/2026
[CVE-2026-71364] A path traversal vulnerability was found in AWX's project archive extraction. The project_archive ac…
A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory traversal sequences. A malicious archive containing members with path traversal components can write file…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
24/08/2026
[CVE-2026-71366] A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. …
A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, or reserved IP ranges. An organization notification administrator can create notification templates p…
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
24/08/2026
[CVE-2025-68825] HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lat…
HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications.
nvdaltovulnerabilidad CVSS 7.5 NVD