Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/07/2026

[CVE-2025-6784] The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, a…

The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode. This is due to the plugin not restricting access to the code injecting functionality of the plugin. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-59721] Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs Gr…

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILER_SMTP_URL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into sendmail transport options, allowing an admin to execute arbitrary commands as root in the backend cont…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-14802] A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the functi…

A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue repo…

nvdaltovulnerabilidad CVSS 7.3 NVD

U Crítico vulnerabilidad

02/07/2026

[CVE-2026-54402] A malicious actor with access to the network and low privileges could exploit an Improper Input Vali…

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-9834] The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is …

The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to OS Command Injection in all versions up to and including 7.11 via the `wp_db_exclude_table` parameter. This is due to the direct concatenation of user-supplied `$_POST['wp_db_exclude_table']` values into the `mysqldump` shell command string in the `mysqldump()` function of `includes/ad…

nvdaltovulnerabilidad CVSS 7.2 NVD

D Alto vulnerabilidad

29/06/2026

[CVE-2026-13545] A vulnerability has been found in D-Link DCS-935L 1.10.01. This affects the function sub_400E40 of t…

A vulnerability has been found in D-Link DCS-935L 1.10.01. This affects the function sub_400E40 of the file setconf.cgi of the component POST Parameter Handler. Such manipulation of the argument UID leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-52806] Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to …

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the "Rebase before merging" merge operation. This vulnerability is fixed in 0.14.3.

nvdcriticovulnerabilidad CVSS 9.9 NVD

P Crítico vulnerabilidad

19/06/2026

[CVE-2026-12045] Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence data…

Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin user's database role. The AI Assistant's execute_sql_query tool runs LLM-generated SQL inside a BEGIN TRANSACTION READ ONLY wrapper to prevent data modification. The LLM-supplied query was forwarded to…

nvdcriticovulnerabilidad CVSS 9.0 NVD

I Crítico vulnerabilidad

18/06/2026

[CVE-2026-38714] InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discov…

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the Python configuration function. This vulnerability allows remote attackers to execute arbitrary commands as root via a crafted input.

nvdcriticovulnerabilidad CVSS 9.8 NVD

I Crítico vulnerabilidad

18/06/2026

[CVE-2026-38715] InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discov…

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the log viewing function. This vulnerability allows remote attackers to execute arbitrary commands as root via a crafted input.

nvdcriticovulnerabilidad CVSS 9.8 NVD

I Crítico vulnerabilidad

18/06/2026

[CVE-2026-38716] InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discov…

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the Python application export function. This vulnerability allows remote attackers to execute arbitrary commands as root via a crafted input.

nvdcriticovulnerabilidad CVSS 9.8 NVD

I Crítico vulnerabilidad

18/06/2026

[CVE-2026-38717] InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discov…

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contain a command injection vulnerability in the file upload function. The vulnerability allows remote attackers to execute arbitrary commands as root via a crafted input.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2024-24909] Dell OpenManage Integration with Microsoft Windows Admin Center contains a Remote Code Execution vul…

Dell OpenManage Integration with Microsoft Windows Admin Center contains a Remote Code Execution vulnerability in the gateway plugin. A remote authenticated user could potentially exploit this vulnerability to escalate privileges. The malicious user may gain the ability to run arbitrary code remotely. This is a high severity vulnerability so Dell recommends customers to upgrade at the earliest opp…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2025-56814] A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to ex…

A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to execute arbitrary code via embedding shell metacharacters.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-12197] A security flaw has been discovered in Ruijie EG105G-P 2.340. The impacted element is the function n…

A security flaw has been discovered in Ruijie EG105G-P 2.340. The impacted element is the function nslookup of the file /cgi-bin/luci/api/diagnose of the component JSON-RPC Diagnose Endpoint. Performing a manipulation of the argument params.target results in command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. T…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

14/06/2026

[CVE-2026-12187] A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Affected by this vulner…

A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Affected by this vulnerability is an unknown functionality of the file /usr/bin/one_click_upgrade of the component Online Firmware Upgrade Handler. Such manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 4.7 addresses …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/06/2026

[CVE-2026-12186] A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function replace_co…

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function replace_country in the library /usr/lib/oui-httpd/rpc/tor of the component Tor Proxy Service Configuration Handler. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 4.7 is abl…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53822] OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could …

OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could change between approval and execution. Attackers can rebuild command arguments after allowlist approval to execute unapproved command shapes, potentially bypassing security controls.

nvdaltovulnerabilidad CVSS 8.8 NVD

K Alto vulnerabilidad

12/06/2026

[CVE-2026-42850] Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject …

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the subshell through kitty error. A special escape code will make kitty return an error, this error is not escaped and will be correctly echoed back to the terminal with CRLF, as such it will be run by the shell in use. To exploit this bug, the victim must use a netcat or a similar p…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46529] Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A si…

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PD…

nvdaltovulnerabilidad CVSS 7.8 NVD