Alertas de Seguridad de la Información

M Alto vulnerabilidad

01/08/2026

Vulnerabilidad alta en GitPython anteriores a 3.1.51 permite inyección de comandos

GitPython antes de la versión 3.1.51 no valida opciones peligrosas de Git en los métodos Repo.archive(), git.ls_remote(), Repo.iter_commits() y Repo.blame(), permitiendo inyección de comandos y ejecución arbitraria a través de parámetros malformados como --exec, --upload-pack u opciones con prefijo guion. Afecta directamente a pipelines CI/CD, sistemas de control de versiones distribuido y herramientas de análisis de código en empresas LATAM que utilizan Python para automatización.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-43830] Full details and mitigation steps are currently restricted and will be published at a later date.

Full details and mitigation steps are currently restricted and will be published at a later date.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-38709] TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR300…

TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the net.set_wan interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-35847] An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping …

An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-7849] Due to improper neutralization of special elements, an unauthenticated remote attacker is able to in…

Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

29/07/2026

[CVE-2026-54680] Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior t…

Logging operator automates the deployment and configuration of Kubernetes logging pipelines. Prior to 6.6.0, the Fluentd configuration renderer FluentRender in pkg/sdk/logging/model/render/fluent.go writes CRD strings such as Flow record_transformer.records values directly into fluent.conf without escaping, allowing a user who can create Flow resources to inject a Fluentd block using @t…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2024-58354] cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerabilit…

cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pull_request_target trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then performs a 'dangerous' checkout of the attacker-submitted pull request code (via the dangerous-git…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-47690] MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions o…

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of `GITHUB_TOKEN` with write permissions to the repository. The vulnerable workflow used pull_request_target, which runs in the context of the base repository with access to secrets. Commit 923820de8f…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-44879] A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authe…

A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform command injection on certain CLI commands. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-52199] An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrar…

An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-30623] LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functional…

LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling attackers to run arbitrary operating system commands. Successful exploitation may result in remote code e…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2025-65720] An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a vi…

An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page.

nvdcriticovulnerabilidad CVSS 9.8 NVD

T Alto vulnerabilidad

15/07/2026

[CVE-2026-46709] Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby insert…

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $(…) and `…`, so the incomplete CVE-2026-45038 fix for control characters still allows code execution when the victim presses Enter. This issue is fixed in …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-56197] Improper neutralization of special elements used in a command ('command injection') in Windows Admin…

Improper neutralization of special elements used in a command ('command injection') in Windows Admin Center allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50488] Improper neutralization of special elements used in a command ('command injection') in Windows Clipb…

Improper neutralization of special elements used in a command ('command injection') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-58635] Improper neutralization of special elements used in a command ('command injection') in Windows Narra…

Improper neutralization of special elements used in a command ('command injection') in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50520] Improper neutralization of special elements used in a command ('command injection') in Visual Studio…

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-48561] Improper neutralization of special elements used in a command ('command injection') in Copilot Chat …

Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

12/07/2026

[CVE-2026-15511] A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerabilit…

A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /usr/bin/webmgnt of the component FastCGI Backend. This manipulation of the argument filename causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor w…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15481] A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. This vulnerability affects…

A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. This vulnerability affects the function ipoa_test of the file /sbin/rc of the component IPoA WAN Connection Setup. Performing a manipulation of the argument ipoa_ipaddr results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The…

nvdaltovulnerabilidad CVSS 8.8 NVD