Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,181
Total alertas
4701
Críticas
16892
Altas
8
Ransomware
1055
Esta semana
RSS
Vulnerabilidades × cwe-78 × Limpiar todo ×
M Alto vulnerabilidad
28/08/2026
[CVE-2026-75486] Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker wh…
Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters..optic-ci.original branch name field. The expectGitBranch() function in src/lint.ts passes the unsanitized branch name directly into child_process.exec() via an unescape…
nvdaltovulnerabilidad CVSS 8.0 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-75121] PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vul…
PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_vlan_membership_edit_dialog_post handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated attacker can send a crafted memberTags value to execute arbitrary operating-system commands on the devi…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-75122] PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vul…
PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A remote attacker with administrator web credentials can submit a crafted certificate upload request to execute…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-75123] PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vul…
PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_smtp_test_post handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with administrator web credentials can send a crafted SMTP server value to execute arbitrary operating-system c…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Crítico vulnerabilidad
28/08/2026
[CVE-2026-37751] An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23bl…
An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
28/08/2026
[CVE-2026-82082] NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remot…
NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-38820] openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injec…
openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /opennds_preauth/ endpoint because of libopennds.sh.
nvdaltovulnerabilidad CVSS 8.3 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
28/08/2026
[CVE-2026-38822] In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the au…
In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.
nvdaltovulnerabilidad CVSS 7.6 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-78037] Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. A…
Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device compromise.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
28/08/2026
[CVE-2026-76060] An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionalit…
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
27/08/2026
[CVE-2026-81698] openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's …
openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containing shell commands that execute when users copy the printed CLI block into a shell.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
27/08/2026
[CVE-2026-81097] The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylis…
The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach them and start a shell, executing commands as the account running the server and outside the guarded m…
nvdaltovulnerabilidad CVSS 8.4 NVD
M Crítico vulnerabilidad
27/08/2026
[CVE-2026-57499] Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vuln…
Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The `ip_address` parameter is embedded directly into a shell command without sanitization, enabling shell escape via single-quote injection. …
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
27/08/2026
[CVE-2026-74233] Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19…
Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated att…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
26/08/2026
[CVE-2026-74770] Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special El…
Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.
nvdaltovulnerabilidad CVSS 8.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
26/08/2026
[CVE-2026-68861] Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special El…
Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
26/08/2026
[CVE-2026-71171] Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special…
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Crítico vulnerabilidad
26/08/2026
[CVE-2026-70419] Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special…
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Alto vulnerabilidad
26/08/2026
[CVE-2026-19042] A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.8…
A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user interaction by clicking the malicious link.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Crítico vulnerabilidad
25/08/2026
Vulnerabilidad crítica en ClipBucket V5: ejecución de comandos arbitrarios en instalador web
El instalador web de ClipBucket V5 no valida correctamente el parámetro php_cli_filepath, permitiendo que atacantes no autenticados ejecuten comandos arbitrarios con privilegios del servidor web mediante una solicitud POST maliciosa. Afecta principalmente a plataformas de video hosting y streaming implementadas en datacenters de LATAM sin actualizaciones de seguridad.
nvdcriticovulnerabilidad CVSS 9.8 NVD