Alertas de Seguridad de la Información

D Alto vulnerabilidad

16/06/2026

[CVE-2026-12161] Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permis…

Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or modify a shared SSH entry to execute arbitrary commands on a remote SSH host using stored elevation credentials via a crafted alternate username and user interaction with the Elevate Shell action. This affects  :  - Remote Desktop Manager 2026.2.5.0 through 2026.2.7.0 - Remote…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-48723] The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on Browse…

The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions prior to 1.36.4 are vulnerable to OS command injection via the cypress_config_file configuration parameter. In readCypressConfigUtil.js, the loadJsFile() function constructs a shell command by interpolating the user-controlled cypress_config_filepath value into a template literal, t…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-50874] An OS command injection vulnerability in the /manage/features/media component of kanishka-linux Remi…

An OS command injection vulnerability in the /manage/features/media component of kanishka-linux Reminiscence v0.3.0 allows attackers to execute arbitrary commands via supplying a crafted input.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-38060] Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_unlo…

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_unlock_sim via the pin parameter.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-38061] Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_…

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_volume via the volume parameter.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-38062] Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_…

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_rat_mode via the ratMode parameter.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-38063] Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_radi…

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_radio_on_with_ia_apn via the ia parameter.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-38064] Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_dial…

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_dial_call via the dialNumber parameter.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-38065] Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_ims_…

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_ims_on_with_apn via the ims_apn parameter.

nvdcriticovulnerabilidad CVSS 9.8 NVD

F Crítico vulnerabilidad

15/06/2026

[CVE-2026-9862] Fortra's  Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in th…

Fortra's  Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing.

nvdcriticovulnerabilidad CVSS 9.8 NVD

F Alto vulnerabilidad

15/06/2026

[CVE-2026-9863] Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch t…

Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS Master during client version handling.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/06/2026

[CVE-2026-11527] Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via…

Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle. Config::IniFiles::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with a pipe ("| cmd", "cmd |") or begins with a redirect ("> path", ">> path") is run as a command or redirect rather t…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

14/06/2026

[CVE-2026-11526] GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of…

GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle. GD::Image::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with a pipe ("| cmd", "cmd |") or begins with a redirect ("> path", ">> path") is run as a command or redirect rather than opened as a file. _ma…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-46716] Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From…

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember user can create a scheduled cron task with Cover=CronCoverAll, Servers=[] and an arbitrary Command. At every tick of the scheduler, the dashboard pushes that command to every server in the global ServerShared map — including servers that belong to…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-48163] MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27…

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shel…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-48165] MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27…

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This …

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-44168] MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26…

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shel…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-44170] MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26…

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP attribute into the curl command line without proper sanitizing. This allows the user to execute shell command…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-11845] The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a OS Command Injecti…

The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a OS Command Injection vulnerability, allowing privileged remote attackers to inject arbitrary OS commands and execute them on the device.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-42846] ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's …

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell commands are run with the URL as a parameter. The URL is concatenated directly into shell commands without escaping then executed, so any shell metacharacter in the URL is interpre…

nvdcriticovulnerabilidad CVSS 9.8 NVD