Alertas de Seguridad de la Información

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102874] A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of th…

A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/local_server/main.py of the component Execute Endpoint. The manipulation of the argument command/shell leads to os command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early thro…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

30/09/2026

[CVE-2026-103056] AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service …

AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py. Authenticated users can inject single quotes into file_path, path, script_name, or script_args parameters to break out of quoted arguments and execute arbitr…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102925] virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the genera…

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches __VIRTUAL_ENV__ when a relocated environment's recorded directory is absent; in the fish scrip…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-100292] In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through …

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if crafted inputs reach the underlying command handler.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102826] simple-git, an interface for running git commands in any node.js application, enables applications t…

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied through customArgs to git.clone(). The missing include.path classification permits Git to load an attacker-controlled configuration file, and t…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-84422] IBM Guardium Data Protection 12.2 is vulnerable to command injection in the CLI certificate SMIME re…

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the CLI certificate SMIME recipient deletion functionality, allowing an authenticated privileged CLI user to execute arbitrary commands with root privileges.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-84436] IBM Guardium Data Protection 12.2 is vulnerable to command injection in the certificate export CLI f…

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the certificate export CLI functionality, allowing a privileged authenticated CLI user to execute arbitrary commands with root privileges.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-84440] IBM Guardium Data Protection 12.2 is vulnerable to command injection in the SNMP alert notification …

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the SNMP alert notification functionality. An authenticated attacker who can influence policy alert text can cause attacker-controlled data to be executed as operating system commands by the SNMP alerter service, which runs with root privileges.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2022-51019] Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation an…

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to execute arbitrary commands on the server.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-86035] Weblate is a web-based continuous localization platform used to manage software translations. Weblat…

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal paths. An authenticated user with project-scoped component.edit permission could exploit this through a …

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-82804] The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization…

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitution syntax, such as $(...), and subsequently supplying the resulting path to the Alert Script plugin's /…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102437] OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSe…

OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasonix Studio) allows a local attacker who controls repository content (.gitattributes + .git/config) to execute arbitrary commands via the desktop app's workspace-changes diff viewer.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/09/2026

Vulnerabilidad alta en shell-quote permite inyección de comandos via función quote()

La función quote() de la librería shell-quote procesa incorrectamente tokens de comentario, permitiendo que un atacante inyecte comandos shell arbitrarios mediante saltos de línea en cadenas de texto. Esta vulnerabilidad afecta aplicaciones Node.js en servidores de LATAM que utilizan shell-quote para sanitización de argumentos, pudiendo comprometer sistemas de CI/CD, contenedores Docker y plataformas de automatización.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-102240] A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the…

A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not res…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-87741] The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versi…

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cp_display_preview_modal AJAX action. The vulnerability exists because the action's nonce guard is gated behind an isset() check and fails open when the cp_admin_page_nonce parameter is omitted entirely, no capability check is performed …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-55157] Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live…

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the smart_user tool. Any MCP client that can call the smart_user tool can execute arbitrary shell commands through the username argument of the get-user-info operation. …

nvdaltovulnerabilidad CVSS 8.4 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-101076] A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the f…

A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /set_ntp_server_ip.cgi of the component CGI Handler. The manipulation of the argument ntp_ip results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-4556] Exam4 is affected by a local privilege escalation vulnerability in the com.extegrity.LogTool privile…

Exam4 is affected by a local privilege escalation vulnerability in the com.extegrity.LogTool privileged helper, which communicates with the application via XPC. The [ConsoleLogHelper copyConsoleIntoFileFromStartDate:] method executes a syslog command using attacker-controlled parameters without proper sanitization, enabling command injection. Successful exploitation allows a local attacker to exec…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-101075] A security vulnerability has been detected in Netcore NR289-GE 1.4.5102. The impacted element is the…

A security vulnerability has been detected in Netcore NR289-GE 1.4.5102. The impacted element is the function system of the file /location_time.cgi of the component Location Time Handler. The manipulation of the argument mac leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about thi…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-101072] A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system …

A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /ap_ip.cgi of the component CGI Handler. Such manipulation of the argument ip leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 10.0 NVD