Alertas de Seguridad de la Información

M Alto vulnerabilidad

01/07/2026

[CVE-2026-13760] OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cd…

OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters in the OsCommand helper. This issue requires the actor to control the content of a…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-58452] JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain an OS command injection…

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by supplying a malicious Wireless parameter to the HTTP PUT NetSDK/Factory SetMAC endpoint. Attackers can craft a string beginning with a valid MAC-like prefix followed by a semicolon and a shell payload, which bypas…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-50043] Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exi…

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge MB-A100/MB-A110. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product with an administrative privilege.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-27957] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, an authenticated command injection vulnerability in the CA Certificate management feature allows any authenticated user to execute arbitrary commands as the configured SSH user on the managed server host. As the SSH user typically would have to either be root or part of the …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-56137] RPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc. contain an OS command injection vulnerabili…

RPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc. contain an OS command injection vulnerability. If a user loads a specially crafted save-file, arbitrary OS command may be executed.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-56808] DGM3103SCT provided by AVTECH Security Corporation contains an OS command injection vulnerability, w…

DGM3103SCT provided by AVTECH Security Corporation contains an OS command injection vulnerability, which may lead to arbitrary command execution with the root privilege by a user who can log in to the web management console of the affected product.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-34594] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, an authenticated command injection vulnerability in the Destination Network Management functionality allows users with destination management permissions to execute arbitrary commands as root on managed servers. The "network" parameter is passed directly to shell commands wi…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-34597] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.470, a critical Authenticated Host Remote Code Execution (RCE) vulnerability was discovered in Coolify. The flaw resides in the handling of user-defined build parameters for the Nixpacks build pack. Specifically, the install_command provided by a user is directly concatenated int…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-57999] luci-app-tailscale-community contains a command injection vulnerability in the tailscale.do_login RP…

luci-app-tailscale-community contains a command injection vulnerability in the tailscale.do_login RPC method that allows authenticated users to execute arbitrary commands as root. The vulnerability exists because user-controlled loginserver and loginserver_authkey parameters are improperly quoted within a double-quoted shell command, allowing shell substitutions like $() to be evaluated by the out…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-58000] luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerabili…

luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerability in the generateKey ubus method where the cl_meta parameter is interpolated into a shell command without proper escaping or quoting. An authenticated LuCI user with OpenVPN protocol configuration access can inject arbitrary shell metacharacters into cl_meta to execute commands as root via the pope…

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

29/06/2026

[CVE-2026-55607] Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling a…

Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such…

nvdaltovulnerabilidad CVSS 8.8 NVD

D Alto vulnerabilidad

29/06/2026

[CVE-2026-13545] A vulnerability has been found in D-Link DCS-935L 1.10.01. This affects the function sub_400E40 of t…

A vulnerability has been found in D-Link DCS-935L 1.10.01. This affects the function sub_400E40 of the file setconf.cgi of the component POST Parameter Handler. Such manipulation of the argument UID leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-55975] A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanit…

A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanitized XML fields to the device's certificate generation interface, which are incorporated into a backend certificate creation command without proper input validation. This may allow for command execution with elevated privileges during certificate generation.

nvdaltovulnerabilidad CVSS 7.2 NVD

N Alto vulnerabilidad

26/06/2026

[CVE-2026-48778] Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <GUIConfig name="comma…

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the tag in config.xml is read by NppXml::value() (Parameters.cpp:6430) and stored in _nppGUI._commandLineInterpreter without any validation, whitelist, or digital signature check. When the user triggers IDM_FILE_OPEN_CMD (File → Open Containing Folder → cmd), NppCommands.cpp:228 crea…

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

26/06/2026

[CVE-2026-48800] Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <Command> tag text con…

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the tag text content inside in shortcuts.xml is read by NppXml::value(aNode) (Parameters.cpp:3658) in the feedUserCmds() function and stored in UserCommand._cmd without any validation. When the user clicks the corresponding entry in the Run menu, NppCommands.cpp:4264 creates a Command object w…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-32833] Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerabili…

Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands by injecting shell metacharacters into the cbid.system.ntp.current POST parameter in the system time configuration interface. Attackers can submit malicious payloads through the NTP settings endpoint to achieve remote code executio…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-55441] mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feat…

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feature gates config files (mise.toml, .tool-versions) through trust_check, but task-include files are loaded on a path that never reaches it. When a directory has a task-include dir (mise-tasks/, .mise/tasks/, …) but no config file, mise falls back to the default includes and renders each task's tera f…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-40711] Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, csi-power…

Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, csi-powerflex v2.16.0, csi-powermax v2.16.0, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-46606] Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEM…

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vms/engines/virsh.py) passes VM domain names, read directly from virsh list --all output, into f-string command templates that are processed by secure_popen(). secure_popen() is explicitly designed to interpret &&, |, and > as shell operators. Because domain name…

nvdaltovulnerabilidad CVSS 7.8 NVD

P Alto vulnerabilidad

25/06/2026

[CVE-2026-55697] pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared…

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.yaml before command dispatch. Before the patch, a repository could declare pacquet or @pnpm/pacquet as a config dependency and pnpm treated that repository-controlled dependency as an install-engine opt-in. During install, pnpm resolved a platform-specific @pacquet/-

nvdaltovulnerabilidad CVSS 7.5 NVD