Alertas de Seguridad de la Información

M Alto vulnerabilidad

12/08/2026

[CVE-2026-16906] IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with el…

IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated privileges due to improper neutralization of special elements used in an OS command.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-48553] Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code …

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the Nagios Remote Data Processor (NRDP). When a custom variable defined on a host, service, or contact is referenced in a shell-executed command line, an authenticated attacker with NRDP access can inject OS commands through the macro value. Expl…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-48554] Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code …

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a shell-reachable position, authenticated UI users can run arbitrary commands as the nagios user. Exploitation requi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-18683] IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authentic…

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-73294] Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, reposi…

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and scheduled commit-hash polling, allowing a project Manager or Owner to execute arbitrary OS commands in the Semaphore server process. This i…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-73263] Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accep…

Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfig_content containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfig_contains_exec_auth in api/src/backend/api/v1/serializers.py checked only exec blocks, and POST /api/v1/providers/{id}/connection loaded it through config.load_kube_config_from_dic…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

12/08/2026

Vulnerabilidad alta de ejecución remota de código en repositorio archivado de Cloudflare

Se ha identificado una vulnerabilidad de ejecución remota de código (RCE) en un repositorio archivado de Cloudflare, explotable a través de configuraciones específicas de GitHub Actions. La vulnerabilidad permite comprometer secretos de flujo de trabajo altas como CLOUDFLARE_API_TOKEN y GITHUB_TOKEN, exponiendo credenciales de acceso a infraestructura en la nube. Empresas en LATAM que utilicen este repositorio o mantengan integraciones con GitHub Actions deben verificar inmediatamente su exposición.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-5917] libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain…

libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository …

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-14863] FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that all…

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes filenames wrapped in shell double-quotes directly to exec() without escapeshellarg() sanitization, allowi…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-73224] electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3…

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in src/client/components/sftp/file-info-modal.jsx inserts the server-controlled folder name into a du -sh shell com…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-73222] Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the…

Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The POST /api/execute endpoint passes the prompt request-body field to executeLocalTask(), and POST /api/i…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-70335] Improper neutralization of special elements used in an os command ('os command injection') in GitHub…

Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-69320] Improper neutralization of special elements used in an os command ('os command injection') in Visual…

Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48385] ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS …

ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-48362] ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS …

ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-67180] Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to …

Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code execution on the worker fleet. Fixed on 2026-07-10.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Crítico vulnerabilidad

11/08/2026

Inyección de comandos OS en wg-easy 15.3.0 permite ejecución como root

Una vulnerabilidad crítica en wg-easy 15.3.0 permite a usuarios con permiso clients.create ejecutar comandos arbitrarios como root mediante inyección de directivas WireGuard malformadas en el campo de nombre del cliente. El software no sanitiza caracteres de salto de línea en la configuración, exponiendo servidores VPN corporativos en LATAM que utilicen esta herramienta de gestión. El acceso requerido es limitado, pero el impacto potencial es total compromiso del sistema.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-72556] A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute…

A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit() and canDelete() methods invoke nonexistent methods on the ZM\User class, causing PHP __call() to return a truthy value that bypasses the permission check for all users. Any authenticated user can trigger filter-b…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-72551] A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Devel…

A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role to execute arbitrary OS commands by exploiting a PHP-Sandbox allow-list bypass. The sandbox allow-list permits functions that transitively invoke system(), enabling a developer to escape the sandbox and gain OS command execution on the server. An attacker with a Developer-role account can …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72901] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an a…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host because the volumeName field accepted by volumeBackup.create and volumeBackup.runManually is interpolated without quoting in packages/server/src/utils/volume-backups/backup.ts and executed through child_process…

nvdcriticovulnerabilidad CVSS 9.9 NVD