Alertas de Seguridad de la Información

M Alto vulnerabilidad

30/07/2026

[CVE-2026-44098] This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via …

This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-16524] A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the n…

A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

28/07/2026

[CVE-2026-14958] IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute ar…

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

28/07/2026

[CVE-2026-14959] IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute ar…

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-59764] ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability …

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-61376] ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability …

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-54540] Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is a…

Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINAL_COMMANDS values, then passes the full command string to shell_exec(). Shell command substitution such as $() is not blocked, so an authenticated use…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-55578] Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before versi…

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell_exec(). After the fix for GHSA-9643-6xjp-vx57 (which added $ to the blocklist), the characters | (single pipe), ` (backtick), and the newline byte (0x0A) …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-48030] Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before versi…

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-24252] NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A s…

NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead to code execution, data tampering, escalation of privileges and information disclosure.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-59687] An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Objec…

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-59688] An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Objec…

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-59686] An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Objec…

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

26/07/2026

[CVE-2026-17497] NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python,…

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in …

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

25/07/2026

[CVE-2026-16766] Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via P…

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection. Version 0.6.0 was released with an incomplete fi…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-65711] sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authentica…

sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via string concatenation, inserting the admin-configurable siteBackupPath setting without escapeshellarg() or e…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-66138] In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can ach…

In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntp_server is passed to a shell.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-63732] 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (…

9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authenticates any fresh installation, a bypass of the LOCAL_ONLY network gate via a spoofed Host header, and unvalidated arguments passed to child_process.spawn() when registering MCP plugins. A remote, unauthenticated attacker can log in with the default credential, spoof the Host head…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-6516] Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code …

Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-16287] Improper neutralization of special elements used in an OS command ('OS command injection') vulnerabi…

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-update allows OS Command Injection. This issue affects pardus-update: from 0.6.6 before 0.7.0.

nvdaltovulnerabilidad CVSS 7.8 NVD