Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/09/2026

Vulnerabilidad alta en Parallels Desktop: escalada de privilegios local vía socket mundial

Parallels Desktop ejecuta el servicio prl_disp_service con permisos root a través de un socket accesible mundialmente (/var/run/prl_disp_service.socket), permitiendo a usuarios locales ejecutar comandos arbitrarios sin validación de firma ni pertenencia a grupos administrativos. La vulnerabilidad afecta principalmente a empresas en México y LATAM que usan Parallels Desktop en infraestructuras de desarrollo, testing y virtualización en macOS, exponiendo sistemas con múltiples usuarios o acceso compartido.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-89066] Improper neutralization of special elements used in an OS command in the task synthesis component in…

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project configuration values and repository file names that are interpolated into generated task definitions. To rem…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-87794] bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip functi…

bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbitrary arguments to the Info-ZIP backend. Attackers can supply a malicious destination path combined with crafted source entries to execute arbitrary commands with Node.js process privileges. Fixed in 2.2.7 and 3.0.3.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85626] git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters …

git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git_log, git_diff, and git_show tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths accessible by the process.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-54085] Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints an…

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, allowing argument injection into tools that run as root. Five of the eight scripts that handle the srcip field, r…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81529] Improper neutralization of delimiters in connection-URL construction allows connection-option inject…

Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is serialized without neutralizing the URL/option delimiters and is then re-parsed as authoritative connec…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80427] bestzip builds the argument list for the system zip utility without separating options from operands…

bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so any source entry beginning with a hyphen is interpreted by zip as an option rather than a file name. zip accepts -T to test the finished archive and -TT to name t…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-78637] A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the …

A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the function pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdfToPs/pdfFonts/pdfDetach/pdfAttach/pdfSeparate/pdfUnite of the file src/index.js of the component Argument Injection Handler. Performing a manipulation of the argument file_path results in argument injection. The attack may be init…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

22/08/2026

Inyección de opciones de línea de comandos en hashcat permite ejecución de código arbitrario

hashcat no restringe adecuadamente las opciones de línea de comandos al procesar archivos de restauración, permitiendo a atacantes inyectar parámetros maliciosos como --outfile y --potfile-path. Esto habilita la escritura arbitraria en archivos del sistema, incluyendo scripts de inicio de shell, comprometiendo servidores de cracking de contraseñas comúnmente utilizados en infraestructuras de seguridad ofensiva y defensiva en organizaciones LATAM.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-63046] Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in …

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd() with no filtering or whitelist validation. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1]/[2] to solve …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-48711] SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SS…

SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as [-oProxyCommand=CMD]:/path and find_base_path() removes the brackets, leaving a host value that begins with - and is passed directly to ssh as a command-line argument. When a caller also supplies a path-valued sftp_server, ssh treats the normalized host a…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-76218] GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards un…

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-76219] GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from…

GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the --index-output option to overwrite arbitrary files with a valid git-index blob, destroying existing file …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-76220] GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard…

GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_option…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-75912] CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool t…

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-73682] Semaphore versions prior to 2.18.20 contain an OS command injection (argument injection) vulnerabili…

Semaphore versions prior to 2.18.20 contain an OS command injection (argument injection) vulnerability in the repository git_url handling that allows authenticated users holding the Manager or Owner role on any project to achieve remote code execution on the Semaphore server host. Attackers can craft a malicious git_url value using git's --upload-pack= option to inject and execute arbitrary shell …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-53790] rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attac…

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into uns…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-53783] rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in …

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

Vulnerabilidad alta en GitPython: sobrescritura arbitraria de archivos en versiones anteriores a 3.1.54

GitPython anterior a la versión 3.1.54 contiene una vulnerabilidad que permite a atacantes sobrescribir archivos arbitrarios mediante el método Diffable.diff, explotando la falta de validación de opciones git. Un atacante puede ejecutar esta acción con los permisos del proceso, afectando sistemas de control de versiones en empresas que usen esta librería en pipelines de CI/CD, especialmente en entornos cloud y DevOps de México y Latinoamérica.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-72538] An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to…

An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git_clone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This represents a distinct code path from the incomplete fix applied for CVE-2026-5366 and allows command …

nvdaltovulnerabilidad CVSS 8.8 NVD