Vulnerabilidades — Alertas SI

R Alto vulnerabilidad

25/06/2026

[CVE-2026-8665] OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Lin…

OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to insufficient input sanitization in shell command construction.

R Alto vulnerabilidad

25/06/2026

[CVE-2026-8666] OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plug…

OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, max_ttl, count, or time_out request parameters due to insufficient input validation when constructing shell commands.

R Alto vulnerabilidad

25/06/2026

[CVE-2026-8592] OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin …

OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to unsafe shell command construction in the processing pipeline.

G Alto vulnerabilidad

25/06/2026

[CVE-2026-9155] OS Command Injection vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated…

OS Command Injection vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the expression parameter due to insufficient input validation.

Q Alto vulnerabilidad

25/06/2026

[CVE-2026-9787] Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability. This vuln…

Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBULogDaemon J…

C Crítico vulnerabilidad

25/06/2026

[CVE-2026-40079] Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vu…

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due to lack of sanitization in the escape_command() function. The escape_command() function at lib/rrd.php is a no-op: it returns $command unchanged. The command line built by rrdtool_function_graph() is passed through this function and then to shell_exec($full_commandl…

C Crítico vulnerabilidad

24/06/2026

[CVE-2026-39938] Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have u…

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph_theme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31.

U Alto vulnerabilidad

24/06/2026

[CVE-2026-9772] Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability. This vulnerabili…

Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The specific flaw exists within FileUpload.php. The issue results from the lack of proper validation of a user-supplied string before using it to execu…

U Alto vulnerabilidad

24/06/2026

[CVE-2026-9773] Unraid Web Server ToggleState Command Injection Remote Code Execution Vulnerability. This vulnerabil…

Unraid Web Server ToggleState Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The specific flaw exists within ToggleState.php. The issue results from the lack of proper validation of a user-supplied string before using it to exe…

R Crítico vulnerabilidad

24/06/2026

[CVE-2026-49980] Rclone is a command-line program to sync files and directories to and from different cloud storage p…

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute l…

M Alto vulnerabilidad

24/06/2026

[CVE-2026-54699] Warp is an agentic development environment. From 0.2024.03.12.08.02.stable_01 until 0.2026.05.06.15.…

Warp is an agentic development environment. From 0.2024.03.12.08.02.stable_01 until 0.2026.05.06.15.42.stable_01, Warp contains an OS command injection vulnerability in the WSL URL-opening fallback. When Warp is running under WSL and cannot open a URL through wslview, it falls back to a Windows command processor path. A URL controlled through terminal output can reach that fallback when the user o…

M Alto vulnerabilidad

24/06/2026

[CVE-2026-48731] Warp is an agentic development environment. From 0.2024.02.20.08.01.stable_01 until 0.2026.05.06.15.…

Warp is an agentic development environment. From 0.2024.02.20.08.01.stable_01 until 0.2026.05.06.15.42.stable_01, Warp contains a command injection issue in the Linux external editor launcher. Warp expanded freedesktop .desktop Exec templates for affected editor integrations and executed the expanded command through a shell. A user who opens an attacker-controlled local file path through an affect…

M Alto vulnerabilidad

24/06/2026

[CVE-2026-48732] Warp is an agentic development environment. From 0.2023.03.21.08.02.stable_00 until 0.2026.05.06.15.…

Warp is an agentic development environment. From 0.2023.03.21.08.02.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command injection issue in the legacy SSH background command path. Warp used the remote working directory reported by the session when building helper commands for SSH-backed metadata collection. A remote host, repository, or directory name controlled by an attacker cou…

M Alto vulnerabilidad

24/06/2026

[CVE-2026-48703] Warp is an agentic development environment. From 0.2025.04.09.08.11.stable_00 until 0.2026.05.06.15.…

Warp is an agentic development environment. From 0.2025.04.09.08.11.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command execution policy bypass in Agent code search tools. The affected Grep and FileGlob actions are authorized as read/search operations, but their implementations build shell command strings from Agent-controlled inputs (search text, paths, glob patterns) and execut…

M Alto vulnerabilidad

24/06/2026

[CVE-2026-48719] Warp is an agentic development environment. From 0.2025.08.06.08.12.stable_00 until 0.2026.05.06.15.…

Warp is an agentic development environment. From 0.2025.08.06.08.12.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command injection in the prompt branch selector. A user who can publish a branch to a Git repository opened in Warp can cause a crafted branch name to be interpreted by the victim's shell if the victim selects that branch from the UI. This vulnerability is fixed in 0.20…

G Alto vulnerabilidad

24/06/2026

[CVE-2026-12537] Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versio…

Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously crafted .gemini/.env file.

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12850] Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVisio…

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various servi…

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12851] Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVisio…

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various servi…

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12486] Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVisio…

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various servi…

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12849] Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVisio…

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various servi…

Alertas de Seguridad de la Información

📬 Alertas semanales SI directo en tu email

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?