Alertas de Seguridad de la Información

M Alto vulnerabilidad

30/07/2026

[CVE-2026-44093] A local privilege escalation vulnerability in the init-script for user-applications allows a low-pri…

A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-44095] A privilege escalation vulnerability in a script used for network configuration allows a low-privile…

A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-44096] A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary …

A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-44098] This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via …

This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-16524] A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the n…

A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

28/07/2026

[CVE-2026-14958] IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute ar…

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

28/07/2026

[CVE-2026-14959] IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute ar…

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-59764] ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability …

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-61376] ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability …

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-54540] Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is a…

Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated use…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-55578] Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before versi…

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell_exec(). After the fix for GHSA-9643-6xjp-vx57 (which added $ to the blocklist), the characters | (single pipe), ` (backtick), and the newline byte (0x0A) …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-48030] Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before versi…

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-24252] NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A s…

NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead to code execution, data tampering, escalation of privileges and information disclosure.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-59687] An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Objec…

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-59688] An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Objec…

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-59686] An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Objec…

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

26/07/2026

[CVE-2026-17497] NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python,…

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in …

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

25/07/2026

[CVE-2026-16766] Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via P…

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection. Version 0.6.0 was released with an incomplete fi…

nvdcriticovulnerabilidad CVSS 9.8 NVD