Alertas de Seguridad de la Información

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93371] A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue aff…

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is c7ad3bd79c7c52…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-85885] Improper neutralization of special elements used in a command ('command injection') in M365 Copilot …

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-78501] Improper neutralization of special elements used in a command ('command injection') in Microsoft 365…

Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-20325] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Das…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20325 are related to improper neutralization of special …

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-20176] A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary comm…

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid high-privileged administrative credentials. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sendi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-92398] A vulnerability was found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this issue is some unk…

A vulnerability was found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this issue is some unknown functionality of the file /etc/rg_config/admin of the component user_list_note Module. Performing a manipulation of the argument Name results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-92397] A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this vulnerabilit…

A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this vulnerability is the function cc_set of the file unifyframe-sgi.elf of the component configChange. Such manipulation of the argument data.url leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

16/09/2026

Vulnerabilidad alta en Arista EOS con gNSI permite escalada de privilegios (CVE-2026-73454)

Plataformas Arista EOS con interfaz gRPC Network Security Interface (gNSI) Credentialz configurada son vulnerables a solicitudes especialmente diseñadas que modifican propiedades de cuentas de usuario. Un atacante podría asignar privilegios elevados a cuentas existentes, comprometiendo el control de acceso en infraestructura de red alta. El impacto afecta directamente a proveedores de servicios y centros de datos en LATAM que dependen de equipos Arista para segmentación y control de tráfico.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-88765] GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before …

GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicode conversion buffer used in Advanced Search indexing.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91853] A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is th…

A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user of the component Export Ovpn Handler. The manipulation of the argument filetype leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90880] A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function s…

A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of the component Diagnostics. Performing a manipulation of the argument Addr results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-90847] A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown functio…

A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90843] A security vulnerability has been detected in SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b89…

A security vulnerability has been detected in SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25. This affects the function nmap_newscan of the file functions_nmap.py of the component New Nmap Scan Handler. Such manipulation of the argument target/params leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Th…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-57130] PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/prais…

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/email_tools.py interpolates LLM-controlled from_addr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can escape the intended criterion and alter IMAP operations when search_emails, reply_email, or archive_e…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

14/09/2026

Inyección de comandos OS en D-Link DWR-M921 1.1.52 permite ejecución remota

Se ha identificado una vulnerabilidad crítica (CVSS 9.1) en el router D-Link DWR-M921 versión 1.1.52 que permite inyección de comandos del sistema operativo a través de la función /boafrm/formDiskFormat. Un atacante remoto puede manipular el parámetro 'partition' para ejecutar comandos arbitrarios sin autenticación. El exploit está publicado y activamente en uso.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

14/09/2026

Inyección de comandos OS en D-Link DWR-M921 versión 1.1.52 (CVE-2026-90703)

Se ha identificado una vulnerabilidad crítica (CVSS 9.1) en el router D-Link DWR-M921 1.1.52 que permite inyección de comandos del sistema operativo a través del parámetro folderpath en la función de creación de comparticiones de disco. El ataque es remotamente exploitable y el exploit público ya circula en la comunidad de seguridad. Esta vulnerabilidad afecta principalmente a PyMES y empresas en LATAM que utilizan estos equipos como gateways de red.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

14/09/2026

Vulnerabilidad crítica en D-Link DWR-M920 1.1.7 permite inyección de comandos OS

Se identificó una debilidad en el enrutador D-Link DWR-M920 versión 1.1.7 que permite inyección de comandos del sistema operativo a través del parámetro newPin en la función /boafrm/formPinManageSetup. El ataque puede ejecutarse remotamente sin autenticación y el exploit ya está disponible públicamente. Afecta principalmente a pequeñas y medianas empresas en LATAM que utilizan este modelo para conectividad de sucursales.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-90690] A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04.…

A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected element is the function subprocess.Popen of the file hexstrike_server.py of the component API Tools Endpoint. Executing a manipulation of the argument additional_args/target/username/password/scan_type/payload can lead to os command injection. The attack can be launched remotely. The e…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-90617] A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a…

A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerability affects the function run_task of the file interface/main.py of the component MCP HTTP Server. Performing a manipulation results in os command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling r…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-90618] A flaw has been found in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This…

A flaw has been found in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This issue affects the function LocalRuntime.execute_command of the file runtime/runtime.py of the component LocalRuntime. Executing a manipulation can lead to os command injection. The attack may be performed from remote. The exploit has been published and may be used. The pull request to fix this issu…

nvdaltovulnerabilidad CVSS 7.3 NVD