Alertas de Seguridad de la Información

M Alto vulnerabilidad

03/08/2026

[CVE-2026-18598] A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function …

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_log of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC plugin. The manipulation of the argument module results in command injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this d…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-18599] A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread…

A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC Plugin. This manipulation of the argument record_size causes command injection. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of …

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

03/08/2026

Vulnerabilidad alta de inyección de comandos en Wavlink WL-NU516U1 708c073-mt7628

Se ha identificado una vulnerabilidad de inyección de comandos del sistema operativo en el enrutador Wavlink WL-NU516U1 versión 708c073-mt7628, específicamente en la función de importación de configuración. Un atacante remoto puede manipular el parámetro de contraseña para ejecutar comandos arbitrarios con altos privilegios. La explotación es técnicamente compleja pero el exploit público ya está disponible, aumentando el riesgo para infraestructuras de PYMES y empresas en LATAM que utilizan estos dispositivos.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/08/2026

Vulnerabilidad alta en GitPython anteriores a 3.1.51 permite inyección de comandos

GitPython antes de la versión 3.1.51 no valida opciones peligrosas de Git en los métodos Repo.archive(), git.ls_remote(), Repo.iter_commits() y Repo.blame(), permitiendo inyección de comandos y ejecución arbitraria a través de parámetros malformados como --exec, --upload-pack u opciones con prefijo guion. Afecta directamente a pipelines CI/CD, sistemas de control de versiones distribuido y herramientas de análisis de código en empresas LATAM que utilizan Python para automatización.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-43830] Full details and mitigation steps are currently restricted and will be published at a later date.

Full details and mitigation steps are currently restricted and will be published at a later date.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-38709] TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR300…

TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the net.set_wan interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-35847] An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping …

An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-7849] Due to improper neutralization of special elements, an unauthenticated remote attacker is able to in…

Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

29/07/2026

[CVE-2026-54680] Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior t…

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd block using @t…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2024-58354] cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerabilit…

cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pull_request_target trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then performs a 'dangerous' checkout of the attacker-submitted pull request code (via the dangerous-git…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-47690] MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions o…

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of `GITHUB_TOKEN` with write permissions to the repository. The vulnerable workflow used pull_request_target, which runs in the context of the base repository with access to secrets. Commit 923820de8f…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-44879] A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authe…

A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform command injection on certain CLI commands. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-52199] An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrar…

An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-30623] LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functional…

LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling attackers to run arbitrary operating system commands. Successful exploitation may result in remote code e…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2025-65720] An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a vi…

An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page.

nvdcriticovulnerabilidad CVSS 9.8 NVD

T Alto vulnerabilidad

15/07/2026

[CVE-2026-46709] Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby insert…

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $(…) and `…`, so the incomplete CVE-2026-45038 fix for control characters still allows code execution when the victim presses Enter. This issue is fixed in …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-56197] Improper neutralization of special elements used in a command ('command injection') in Windows Admin…

Improper neutralization of special elements used in a command ('command injection') in Windows Admin Center allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50488] Improper neutralization of special elements used in a command ('command injection') in Windows Clipb…

Improper neutralization of special elements used in a command ('command injection') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-58635] Improper neutralization of special elements used in a command ('command injection') in Windows Narra…

Improper neutralization of special elements used in a command ('command injection') in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50520] Improper neutralization of special elements used in a command ('command injection') in Visual Studio…

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 8.4 NVD