Alertas de Seguridad de la Información

M Alto vulnerabilidad

16/07/2026

[CVE-2026-55173] WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS comman…

WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & ( the shell background operator). CVE-2026-33482 reported that sanitizeFFmpegCommand() (plugin/API/standAlone/functions.php) failed to strip $(...) command substitution, allowing OS command injecti…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-63304] AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/function…

AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses() function interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can break out of the single-quoted grep context and execute arbitrary OS commands as the web-server user.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-63305] AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint w…

AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft a valid encrypted payload can inject arbitrary shell metacharacters into these fields to execute OS commands as the web-server user.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-62312] 9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacke…

9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating system by combining a Host header bypass of localhost-only routes with unvalidated MCP plugin args passed to child_process.spawn(), allowing malicious custom plugins to execute commands through /api/mcp//sse. This issue is fixed in version …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-15895] OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allo…

OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or later.

nvdaltovulnerabilidad CVSS 7.8 NVD

T Alto vulnerabilidad

15/07/2026

[CVE-2026-46709] Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby insert…

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $(…) and `…`, so the incomplete CVE-2026-45038 fix for control characters still allows code execution when the victim presses Enter. This issue is fixed in …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-61438] PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_…

PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_inline_python() due to insufficient AST validation of workflow script steps. Attackers can create malicious YAML workflow files with import os statements followed by os.system() calls that bypass sandbox checks and execute arbitrary OS commands with process privileges.

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48345] Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Com…

Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

nvdaltovulnerabilidad CVSS 8.2 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48347] Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Com…

Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

nvdaltovulnerabilidad CVSS 7.7 NVD

H Alto vulnerabilidad

10/07/2026

[CVE-2025-30007] HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-p…

HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_domain_zone() to premature…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-54149] MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-lts, MaxKB tool import function…

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-lts, MaxKB tool import functionality in apps/tools/serializers/tool.py and MCP referencing mode in apps/application/chat_pipeline/step/chat_step/impl/base_chat_step.py do not consistently validate MCP transport type, allowing an authenticated user to import a .tool file containing stdio transport with malicious commands and trigg…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-61434] PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command executio…

PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via find's built-in -exec, -execdir, and -delete actions. Attackers can craft find commands with these built-in actions to read blocked files, delete files, or execute non-allowlisted binaries without triggering shell metacharacter filters.

nvdaltovulnerabilidad CVSS 8.8 NVD

P Alto vulnerabilidad

09/07/2026

[CVE-2026-0286] A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software ena…

A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to execute arbitrary OS commands as root. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls an…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-59721] Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs Gr…

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the updateInfraConfigs GraphQL mutation in admin/infra.resolver.ts accepts an attacker-controlled MAILER_SMTP_URL value, and validateSMTPUrl in utils.ts permits path, query, or fragment content that nodemailer parses into sendmail transport options, allowing an admin to execute arbitrary commands as root in the backend cont…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-59734] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, Coolify's app/Jobs/ApplicationDeploymentJob.php generate_healthcheck_commands() function directly interpolated the health_check_host, health_check_method, and health_check_path parameters into shell commands without proper sanitization, allowing authenticated users to execut…

nvdaltovulnerabilidad CVSS 8.8 NVD

D Alto vulnerabilidad

09/07/2026

[CVE-2026-55420] Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5…

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-default configurations, processing of PDF uploads could be exploited to obtain RCE on the server. This issue is patched in 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

09/07/2026

[CVE-2026-58459] gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in …

gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnup…

nvdaltovulnerabilidad CVSS 7.8 NVD

C Alto vulnerabilidad

09/07/2026

[CVE-2026-41857] A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's work…

A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when the operator runs bosh ssh (or bosh scp/bosh logs -f) with default flags. Affected versions: BOSH CLI versions prior to 7.10.5.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-60102] Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in t…

Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver where the _escapeShellCommand() method fails to sanitize command substitution sequences, allowing authenticated attackers to inject arbitrary shell commands through user-controlled filenames. Attackers can supply malicious filenames containing unescaped command substitution p…

nvdaltovulnerabilidad CVSS 8.8 NVD

C Alto vulnerabilidad

08/07/2026

[CVE-2026-24700] An OS command injection vulnerability exists in the start_lltd() function of the "rc" binary in Cisc…

An OS command injection vulnerability exists in the start_lltd() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The machine_name configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.

nvdaltovulnerabilidad CVSS 7.2 NVD