Alertas de Seguridad de la Información

M Alto vulnerabilidad

03/08/2026

[CVE-2026-67608] Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a…

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/08/2026

Vulnerabilidad alta de inyección de comandos en Wavlink WL-NU516U1 708c073-mt7628

Se ha identificado una vulnerabilidad de inyección de comandos del sistema operativo en el enrutador Wavlink WL-NU516U1 versión 708c073-mt7628, específicamente en la función de importación de configuración. Un atacante remoto puede manipular el parámetro de contraseña para ejecutar comandos arbitrarios con altos privilegios. La explotación es técnicamente compleja pero el exploit público ya está disponible, aumentando el riesgo para infraestructuras de PYMES y empresas en LATAM que utilizan estos dispositivos.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

01/08/2026

Vulnerabilidad crítica en GitPython 3.1.50 permite bypass de validación de opciones inseguras

GitPython 3.1.50 no reconoce correctamente opciones cortas concatenadas (como -u) al validar parámetros de clonación, permitiendo a atacantes eludir restricciones de seguridad mediante la opción --upload-pack/-u. Esta vulnerabilidad afecta aplicaciones que procesan opciones de clonación controladas por usuarios sin validación adicional, comprometiendo la integridad de repositorios Git en entornos empresariales.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

01/08/2026

Vulnerabilidad alta de inyección de comandos en GitPython anterior a 3.1.51

GitPython versiones anteriores a 3.1.51 contiene un filtro incompleto contra inyección de comandos que no valida correctamente las abreviaturas de opciones largas de Git. Atacantes pueden ejecutar comandos arbitrarios utilizando nombres de opciones abreviados (ej: upload_p en lugar de upload_pack), afectando sistemas de CI/CD, repositorios corporativos y plataformas DevOps en empresas mexicanas y latinoamericanas que dependen de esta librería para automatización.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

01/08/2026

Vulnerabilidad crítica de inyección de comandos en flujos de trabajo de Wazuh (CVE-2026-67308)

Los flujos de trabajo de Wazuh anteriores a la versión 44bf114 contienen una vulnerabilidad de inyección de shell en GitHub Actions que permite a atacantes ejecutar comandos arbitrarios mediante pull requests manipulados con archivos VERSION.json especialmente crafteados. La explotación facilita la inyección de metacaracteres de shell en variables de entorno interpoladas directamente en pasos de ejecución, permitiendo robo de secretos como GITHUB_TOKEN y acceso no autorizado a sistemas CI/CD en organizaciones de LATAM que usen este software para orquestación de seguridad.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-17566] pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-s…

pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create_import_export_job() (route POST /import_export/job/, gated only by the ordinary, commonly-granted tools_import_export_data permission) …

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-17347] The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an ex…

The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the command string and executed the result with subprocess.Popen(..., shell=True). Because the username can …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-16843] Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insuf…

Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-12943] IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management sys…

IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-12940] IBM Langflow OSS 1.0.0 through 1.10.1  are vulnerable to unauthenticated remote code execution via e…

IBM Langflow OSS 1.0.0 through 1.10.1  are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUS_ENV_VARS blocklist fails to include SHELLOPTS , BASHOPTS , and PS4 environment variables.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-14522] IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a …

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-22621] Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PA…

Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to execute arbitrary commands within a restricted environment.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-22622] Improper input validation in one of the session management interface of Eaton's Tripp Lite series PA…

Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate privileges resulting in unrestricted access to the device.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-44106] A privilege escalation vulnerability in the init-script for user-applications allows a low-privilege…

A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-44099] A privilege escalation vulnerability in the system configuration allows a low-privileged local user …

A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-44093] A local privilege escalation vulnerability in the init-script for user-applications allows a low-pri…

A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-44095] A privilege escalation vulnerability in a script used for network configuration allows a low-privile…

A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-44096] A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary …

A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-44098] This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via …

This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-16524] A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the n…

A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.

nvdaltovulnerabilidad CVSS 7.8 NVD