Alertas de Seguridad de la Información

M Alto vulnerabilidad

08/06/2026

[CVE-2026-25855] OpenBullet2 through version 0.3.2 contains a remote code execution vulnerability that allows authent…

OpenBullet2 through version 0.3.2 contains a remote code execution vulnerability that allows authenticated users to execute arbitrary commands by uploading script files (.bat.ps1.sh) through the FileProxySource proxy loading feature. Attackers can upload malicious script files as proxy sources, causing the server to execute the scripts and return output as proxy lines, resulting in arbitrary comma…

nvdaltovulnerabilidad CVSS 8.8 NVD

B Crítico vulnerabilidad

05/06/2026

[CVE-2026-45777] OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Starting in version 9.5.0 a…

OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Starting in version 9.5.0 and prior to version 11.0.3, an attacker can remotely execute arbitrary system commands on the web server hosting Open XDMoD with the privileges of the web server process. This could allow an attacker to read or modify application data, alter system configuration, or disrupt service availability. All…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-49492] Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a sh…

Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document - the diagram filename attribute, imported file paths, and the latex_engine code-chunk attribute. On Windows, a crafted markdown document can inject operating system commands that execute when the document is previewed. Fixe…

nvdaltovulnerabilidad CVSS 8.8 NVD

T Crítico vulnerabilidad

05/06/2026

[CVE-2026-45750] Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa…

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in the Termix File Manager component unsafely processes the path parameter and embeds it into a shell command executed over the active SSH session. Because the user-controlled value is placed inside double quotes an…

nvdcriticovulnerabilidad CVSS 9.0 NVD

T Crítico vulnerabilidad

05/06/2026

[CVE-2026-45748] Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa…

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /ssh/tunnel/connect` endpoint in Termix prior to version 2.3.2 builds an SSH tunnel command by interpolating user-controlled host record fields (`endpointIP`, `endpointUsername`, `password`) directly into a shell command without escaping, allowing persistent OS command injection …

nvdcriticovulnerabilidad CVSS 9.8 NVD

T Crítico vulnerabilidad

05/06/2026

[CVE-2026-45744] Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa…

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in Termix is vulnerable to OS command injection. The endpoint uses double-quote escaping for shell command construction, which does not prevent $(...) and backtick command substitution. Any authenticated user with a…

nvdcriticovulnerabilidad CVSS 9.9 NVD

H Alto vulnerabilidad

05/06/2026

[CVE-2026-21837] HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Man…

HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API.  An attacker may execute arbitrary operating system commands, typically inheriting the privileges of the vulnerable application, which could possibly lead to a complete system takeover and data compromise.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10872] A vulnerability was found in Shibby Tomato 1.28.0000. This issue affects the function start_vpnserve…

A vulnerability was found in Shibby Tomato 1.28.0000. This issue affects the function start_vpnserver of the file /sbin/rc of the component Web UI. Performing a manipulation results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used. This project is superseded by FreshTomato.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10873] A vulnerability was determined in Shibby Tomato 1.28.0000. Impacted is the function rstats_path of t…

A vulnerability was determined in Shibby Tomato 1.28.0000. Impacted is the function rstats_path of the file /bin/rstats of the component Web UI. Executing a manipulation can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This project is superseded by FreshTomato.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10871] A vulnerability has been found in Shibby Tomato 1.28.0000. This vulnerability affects the function s…

A vulnerability has been found in Shibby Tomato 1.28.0000. This vulnerability affects the function start_6rd_tunnel of the file /sbin/rc of the component Web UI. Such manipulation of the argument ipv6_6rd_borderrelay leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This project is superseded by FreshTomato.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10870] A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file …

A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file /sbin/rc of the component Web UI. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This project is superseded by FreshTomato.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2025-69755] An issue in Neterbit NW-431F Router vNW-431F-20241014-IR03 allows a remote attacker to obtain sensit…

An issue in Neterbit NW-431F Router vNW-431F-20241014-IR03 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted command to the at_command.asp interface

nvdaltovulnerabilidad CVSS 8.2 NVD

O Alto vulnerabilidad

04/06/2026

[CVE-2026-10796] nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied …

nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as `nvm install` read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs and shell/awk commands. Two sinks are affected by the same untrusted input: nvm_download() built a…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

04/06/2026

[CVE-2025-67447] The network diagnosis (ping) module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerabl…

The network diagnosis (ping) module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to OS command injection. The application does not properly sanitize user input in the IP address field before passing it to the system's ping command. An attacker can inject arbitrary OS commands, which will be executed with the privileges of the web server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/06/2026

[CVE-2026-35906] An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 allow…

An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 allows unauthenticated attackers to execute arbitrary system commands as root via supplying a crafted HTTP query string.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-3820] There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-2115HS-TNR.  An attack…

There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-2115HS-TNR.  An attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execute unintended commands during process invocation. Potential impact includes denial-of-service attacks, arbitrary code execution, or perman…

nvdaltovulnerabilidad CVSS 7.2 NVD

A Alto vulnerabilidad

04/06/2026

[CVE-2026-49190] The system fails to evaluate instructional permissions over multiple internal operation codes (opcod…

The system fails to evaluate instructional permissions over multiple internal operation codes (opcodes), permitting unauthorized application installations or command executions.

nvdaltovulnerabilidad CVSS 8.8 NVD

A Crítico vulnerabilidad

04/06/2026

[CVE-2026-49185] The FieldX MDM adb messaging topic passes unverified payloads directly into Runtime.exec(), allowing…

The FieldX MDM adb messaging topic passes unverified payloads directly into Runtime.exec(), allowing command/instruction injection.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-41010] ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@re…

ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@release_dir, 'jobs', "#{name}.tgz") where name returns @job_meta['name'], a value taken verbatim from the jobs: array of the attacker-supplied release.MF inside the uploaded tarball. These paths are then interpolated into a shell string: Bosh::Common::Exec.sh("tar -C #{job_dir} -xf #{job_tgz} 2>&1", :…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-41011] PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packa…

PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packages', "#{name}.tgz") and name = package_meta['name'] comes directly from release.MF inside the uploaded tarball. The string is passed to Bosh::Common::Exec.sh, which executes via %x{} — i.e., /bin/sh -c. No Shellwords.escape is applied. The Models::Package Sequel validation (VALID_ID = /^[-0-9A-Za-z…

nvdaltovulnerabilidad CVSS 8.2 NVD