Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71912] Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. …

Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing length checks during memory copy operations involving the CMD6 field. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credent…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71913] Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative creden…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71915] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus func…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credent…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71906] Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. Th…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the devi…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71907] Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function.…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's we…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71908] Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_te…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is caused by insufficient sanitization of the meshdevice_index and meshdevice_ip fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administ…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71909] Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime functio…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web mana…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71910] Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71911] Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The …

Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The vulnerability is caused by missing length checks during memory copy operations involving the lanVlanId0, lanIp, and lanNetmask fields. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires va…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71904] Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform fun…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the event_code field is concatenated into a system command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid a…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-71905] Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings func…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the backupkey, backuptype, and realtime fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative cr…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-78465] A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX…

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersize…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-78367] A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source arc…

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execu…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-76848] TypeORM's SelectQueryBuilder.distinctOn accepts an array of strings and stores it on the expression …

TypeORM's SelectQueryBuilder.distinctOn accepts an array of strings and stores it on the expression map without validation. For PostgreSQL-family drivers, createSelectDistinctExpression in src/query-builder/SelectQueryBuilder.ts joins that array and interpolates the result into the generated statement as SELECT DISTINCT ON (values), with no escaping, quoting, identifier validation or allowlist, an…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad Nuevo

Hace 46 min

Vulnerabilidad XSS sin autenticación en Urna versiones ≤2.6.2 (CVSS 7.1)

Se ha identificado una vulnerabilidad de Cross Site Scripting (XSS) sin autenticación en Urna versiones 2.6.2 e inferiores que permite a atacantes inyectar código malicioso y comprometer sesiones de usuarios. Esta vulnerabilidad afecta especialmente a plataformas de votación y gestión electoral en organismos públicos y privados de LATAM. El riesgo es alto dado que no requiere credenciales previas para explotarse.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 46 min

Eliminación arbitraria de archivos sin autenticación en ShopBuilder Pro ≤ 2.2.0

ShopBuilder Pro, extensión de Elementor para WooCommerce, presenta una vulnerabilidad alta (CVSS 8.6) que permite a atacantes no autenticados eliminar archivos arbitrarios del servidor. Afecta directamente a tiendas en línea y sitios de comercio electrónico en México y LATAM que utilizan versiones anteriores a 2.2.1. El riesgo es severo: pérdida de datos altas, degradación de servicios y potencial exposición de información sensible.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad Nuevo

Hace 8 horas

[CVE-2026-19200] The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other is…

The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions.  The attacker need only have the NOTEBOOK_EDIT permission (e.g. an analyst role) to be able to call this function.

nvdaltovulnerabilidad CVSS 8.9 NVD

M Alto vulnerabilidad Nuevo

Hace 22 horas

[CVE-2026-9769] justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial o…

justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the DOM tree via _find_elements()/_find_element() without a depth bound. An attacker who can supply HTML for parsing can provide deeply nested elements (e.g.…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 1 día

Vulnerabilidad alta en GitLab CE/EE permite ejecución remota de código

GitLab ha reportado una vulnerabilidad de path traversal en el registro de paquetes que afecta versiones 18.8 a 19.2.1, permitiendo a usuarios autenticados ejecutar código remoto. Esta afecta directamente a empresas en LATAM que utilizan GitLab como plataforma de CI/CD y gestión de repositorios. El CVSS 8.5 indica severidad alta, requiriendo acción inmediata en entornos productivos.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-77115] Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into pop…

Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them.

nvdaltovulnerabilidad CVSS 7.1 NVD