Alertas de Seguridad de la Información

M Alto vulnerabilidad

28/09/2026

[CVE-2026-101007] A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputS…

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-101009] A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function p…

A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function panelTask.bt_task._unzip of the file /www/server/panel/class/panelTask.py of the component Unzip Handler. Executing a manipulation of the argument Password can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendo…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-101045] Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metada…

Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests generated before 2026-08-19, the script generator escaped this metadata at some interpolation sites but not all of them, so cask metadata containing shell metacharacters (for example $(...) command substitution) could be carried into scripts that execute as root on managed macOS hos…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-101032] navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into …

navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

27/09/2026

Vulnerabilidad de inyección de comandos en AzuraCast 0.23.x afecta servidores de radio

AzuraCast versiones hasta 0.23.x contiene una vulnerabilidad de inyección de comandos en la generación de configuración de Liquidsoap para grabaciones en vivo. Usuarios autenticados con permisos de Streamers pueden insertar metacaracteres de shell en nombres de usuario y ejecutar comandos con privilegios del proceso Liquidsoap cuando finaliza la grabación. Esta vulnerabilidad afecta principalmente a emisoras de radio y plataformas de streaming que utilizan AzuraCast en infraestructura on-premise o en la nube en LATAM.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-100844] MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps…

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values taken from the YAML configuration file (notably dataset_name_or_id) and from CLI/kwargs arguments are concatenated into a command string without quoting or validation and then passed to subprocess with shell=True, so shell metacharacters (e.g., ';' on…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

26/09/2026

Vulnerabilidad alta en OpenClaw 2026.5.1-2026.7.0 omite validación de comandos Google Meet

OpenClaw versiones 2026.5.1 a 2026.7.0 no aplican la ruta de aprobación configurada para comandos del nodo Google Meet, permitiendo que arrays de audio suministrados por atacantes se ejecuten sin validación en nodos Chrome emparejados. En despliegues con el plugin de Google Meet activo, esto expone las videollamadas empresariales y sistemas de comunicación a ejecución de código no autorizado. El impacto es alta (CVSS 8.8) en organizaciones LATAM que dependen de infraestructura de comunicaciones unificadas.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100559] OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines conf…

OpenClaw versions before 2026.8.1 contain a command parser vulnerability where escaped newlines confuse exec allowlist parsing, allowing hidden commands to execute. Attackers can craft input with escaped newlines to bypass allowlist validation and execute additional commands without expected authorization prompts.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-100368] CliInvoke is a .NET library for invoking command-line programs, and its `CliInvoke.Specializations` …

CliInvoke is a .NET library for invoking command-line programs, and its `CliInvoke.Specializations` packages provide specialized wrappers for shells such as PowerShell and Windows Command Prompt. `CliInvoke.Specializations` versions 2.2.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, 3.0.0-alpha.1 through 3.0.0-alpha.4, and 3.0.0-alpha.8 through 3.0.0-alpha.10, as well as `AlastairLun…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-91838] A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivilege…

A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped characters are then processed by the `pppd` daemon, which runs with root privileges, allowing the attacke…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-91837] A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivi…

A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the 'nameserver' setting is processed when establishing an iodine VPN connection. By embedding shell metacharacters (special characters that can execute commands) in the 'nameserver' value, an attacker can inject and execute arbitrary commands. These com…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-85542] IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle…

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provide a crafted GIM bundle that causes attacker-controlled arguments to be passed to the tar command, resulting in arbitrary command execution with elevated privileges on the Central Manager.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93289] The affected products are vulnerable to command injection attack that could allow an unauthenticated…

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-13248] An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command …

An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows an authenticated user with access to the admin or itadmin account to submit commands written in the Intermec Fingerprint programming language directly to the printer ’s internal…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-81552] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute a…

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-81539] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute a…

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-81545] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute a…

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-81548] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute a…

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-95519] A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a us…

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitat…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-95521] A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spe…

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an…

nvdaltovulnerabilidad CVSS 7.8 NVD