Alertas de Seguridad de la Información

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19963] A vulnerability has been found in Edimax EW-7478APC 1.04. Affected by this issue is the function sta…

A vulnerability has been found in Edimax EW-7478APC 1.04. Affected by this issue is the function stainfo of the file /goform/stainfo. The manipulation of the argument interface leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19962] A flaw has been found in Edimax EW-7478APC 1.04. Affected by this vulnerability is the function setW…

A flaw has been found in Edimax EW-7478APC 1.04. Affected by this vulnerability is the function setWAN of the file /goform/setWAN. Executing a manipulation of the argument pppUserName/pptpUserName/L2TPUserName can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respo…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

16/08/2026

[CVE-2026-19960] A security vulnerability has been detected in Edimax EW-7478APC 1.04. This impacts the function form…

A security vulnerability has been detected in Edimax EW-7478APC 1.04. This impacts the function formWlbasic of the file /goform/formWlbasic. Such manipulation of the argument rootAPmac leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-50523] Improper neutralization of special elements used in a command ('command injection') in Microsoft Pow…

Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an authorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19771] A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA. This impacts an unknown fun…

A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web Interface. Such manipulation of the argument MaxHops/Timeout/Size leads to os command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure bu…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-19747] A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14…

A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injection. The attack is possible to be carried out remotely.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-68792] Improper neutralization of special elements used in a command ('command injection') in Microsoft Off…

Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-65656] Improper neutralization of special elements used in a command ('command injection') in Microsoft Off…

Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an unauthorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-49179] Improper neutralization of special elements used in a command ('command injection') in Windows Activ…

Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-47299] Improper neutralization of special elements used in a command ('command injection') in Azure Monitor…

Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72869] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreB…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName parameter to restore builders in packages/server/src/utils/restore/utils.ts, where PostgreSQL, MariaDB, MySQL, and MongoDB commands embed the value in nested shell text executed by Node.js exec. An authenticated user with backup:restore permiss…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72736] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy passes user…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquoted template literal interpolation in the registry credential testing and Docker Swarm cluster management endbpoints. Both endpoints have a safe local code path (using execFileAsync or the Docker API) but a vulnerable remote path (using execAs…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72735] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigR…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed through execAsyncRemote. Single quotes in redirect regex and replacement fields, basic authentication us…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-19379] A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the …

A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

09/08/2026

Inyección de comandos crítica en repetidor Wi-Fi Aitemi M300 (CVE-2026-19348)

Se ha identificado una vulnerabilidad crítica (CVSS 9.8) en el repetidor Wi-Fi Aitemi M300 (versión r0-ea7890a) que permite inyección de comandos remotos a través de manipulación de parámetros en la función sprintf del archivo /protocol.csp. Un atacante puede explotar este defecto sin autenticación para ejecutar comandos arbitrarios en el dispositivo. El exploit ya es público, elevando significativamente el riesgo para infraestructuras de conectividad en México y Latinoamérica.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

09/08/2026

Vulnerabilidad alta de inyección de comandos en Tenda CH22 1.0.0.1

Se identificó una vulnerabilidad de inyección de comandos (CVE-2026-19346, CVSS 8.8) en el router Tenda CH22versión 1.0.0.1, específicamente en la función formCertListInfo del endpoint /goform/CertListInfo. Un atacante remoto puede manipular el parámetro Name para ejecutar comandos arbitrarios sin autenticación. Esta vulnerabilidad está públicamente divulgada y es activamente explotada en ataques.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/08/2026

Inyección de comandos alta en INQUIRELAB mcp-bridge-api (CVE-2026-19263)

Se identificó una vulnerabilidad de inyección de comandos en el componente Servers Endpoint del archivo mcp-bridge.js de INQUIRELAB mcp-bridge-api. Un atacante remoto podría manipular los parámetros command/args para ejecutar comandos arbitrarios en servidores afectados. Esta vulnerabilidad impacta directamente sistemas de integración de APIs en infraestructuras empresariales de México y Latinoamérica que utilizan esta librería en versiones anteriores a b30a82aa1d1d1139e0de846c41c8aadee6e06114.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-19036] A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub_40F88C…

A security flaw has been discovered in Shibby Tomato 1.28.0000. This affects the function sub_40F88C of the file /tmp/ppp/wanoptions. The manipulation of the argument ppp_custom results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This project is superseded by FreshTomato.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

06/08/2026

Vulnerabilidad alta de inyección de comandos en Shibby Tomato 1.28.0000

Se identificó una vulnerabilidad de inyección de comandos del sistema operativo en Shibby Tomato 1.28.0000 a través del parámetro new_qoslimit_enable en la función new_qoslimit_start del archivo /etc/qoslimit. Esta falla permite a atacantes remotos ejecutar comandos arbitrarios con privilegios del router, afectando principalmente a empresas y proveedores de servicios en LATAM que utilizan este firmware en equipos de red altas. El exploit está disponible públicamente.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

06/08/2026

Inyección de comandos OS en Shibby Tomato 1.28.0000 permite ejecución remota

Se identificó una vulnerabilidad de inyección de comandos en Shibby Tomato 1.28.0000 que afecta la función new_qoslimit_stop en /tmp/qoslimittc_stop.sh. Un atacante remoto puede manipular el parámetro wan_iface para ejecutar comandos del sistema operativo con privilegios del dispositivo. El exploit es público y activamente utilizado. Nota: Este proyecto ha sido descontinuado en favor de FreshTomato.

nvdaltovulnerabilidad CVSS 7.2 NVD