Alertas de Seguridad de la Información

M Alto vulnerabilidad

27/07/2026

[CVE-2026-59688] An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Objec…

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-59686] An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Objec…

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

26/07/2026

[CVE-2026-17497] NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python,…

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in …

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-65711] sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authentica…

sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via string concatenation, inserting the admin-configurable siteBackupPath setting without escapeshellarg() or e…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-66138] In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can ach…

In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntp_server is passed to a shell.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-16287] Improper neutralization of special elements used in an OS command ('OS command injection') vulnerabi…

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-update allows OS Command Injection. This issue affects pardus-update: from 0.6.6 before 0.7.0.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-14881] When importing connections in Compass it is possible to override some connection options that are ot…

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-44191] A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vuln…

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell separators. This can be triggered automatically during Language Server initialization or manually when ex…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-44190] A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vuln…

A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vulnerability (CWE-78) allows a remote attacker to execute unauthorized commands on a user's system. The issue occurs because the `ansible.python.activationScript` setting, intended for a virtual environment activation script, does not properly validate user input as a file path. If a user opens or exec…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-3821] Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI. …

Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI. An authorized attacker can exploit SMASH’s input capability to compromise data integrity or launch a Denial-of-Service (DoS) attack against the BMC.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-64881] The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow int…

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16445] A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability…

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to comman…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-6952] A post-authentication command injection vulnerability in the "LogServer" field of the syslog compone…

A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17(ABPC.7.2)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-14448] An high privileged remote attacker can exploit an authenticated OS command injection vulnerability i…

An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the system_certificates view due to improper neutralization of special elements in an OS command. This can result in a total loss of confidentiality, availability and integrity.

nvdaltovulnerabilidad CVSS 7.2 NVD

S Alto vulnerabilidad

17/07/2026

[CVE-2026-50289] systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterf…

systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces() on Linux is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive because lib/network.js checkLinuxDCHPInterfaces() reads /etc/network/interfaces, extracts a source token from file content, and interpolates it unquoted into cat ${file} 2> /dev/null…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

17/07/2026

[CVE-2026-14499] IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrar…

IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input in the Python Interpreter component.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-58195] Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools i…

Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated.ts, src/mcp/fastmcp/servers/http-sse.ts, src/mcp/fastmcp/servers/poc-stdio.ts, src/mcp/fastmcp/tools/agent/{execute,list,parallel}.ts, src/…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-55173] WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS comman…

WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & ( the shell background operator). CVE-2026-33482 reported that sanitizeFFmpegCommand() (plugin/API/standAlone/functions.php) failed to strip $(...) command substitution, allowing OS command injecti…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-63304] AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/function…

AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses() function interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can break out of the single-quoted grep context and execute arbitrary OS commands as the web-server user.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-63305] AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint w…

AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft a valid encrypted payload can inject arbitrary shell metacharacters into these fields to execute OS commands as the web-server user.

nvdaltovulnerabilidad CVSS 8.1 NVD