Alertas de Seguridad de la Información

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-19682] A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker…

A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19635] A local privilege escalation vulnerability exists in Security Center. An attacker with write access …

A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19628] A command injection vulnerability exists in Tenable Security Center. An authenticated administrator …

A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19771] A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA. This impacts an unknown fun…

A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web Interface. Such manipulation of the argument MaxHops/Timeout/Size leads to os command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure bu…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73667] OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and …

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -c instead of passing the values through container.env, allowing arbitrary commands to run in workflow p…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73570] A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the o…

A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands a…

nvdaltovulnerabilidad CVSS 8.9 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-53790] rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attac…

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into uns…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

Vulnerabilidad alta en GitPython permite ejecución de comandos arbitrarios en operaciones de clonación

GitPython versiones anteriores a 3.1.54 contiene una denylist incompleta que omite la opción --template, permitiendo a atacantes ejecutar comandos arbitrarios mediante hooks maliciosos durante operaciones de clonación. Esta vulnerabilidad afecta directamente a sistemas CI/CD, pipelines de desarrollo y servidores que utilizan GitPython para automatizar gestión de repositorios, siendo alta en entornos DevOps de empresas en LATAM que dependen de flujos de integración continua.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

Vulnerabilidad alta de ejecución remota de código en GitPython anteriores a 3.1.54

GitPython versiones anteriores a 3.1.54 contiene una vulnerabilidad de ejecución remota de código (RCE) que permite a atacantes eludir validaciones de seguridad mediante opciones git manipuladas. Los métodos clone_from, fetch, pull, push, ls_remote, iter_commits, blame y archive pueden ser explotados para ejecutar comandos arbitrarios del sistema operativo. Empresas en LATAM que usen GitPython en pipelines CI/CD, sistemas de gestión de repositorios o herramientas de DevOps están en riesgo alta de comprometer servidores y datos sensibles.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-49819] UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentica…

UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperuser` (`backend/pb/handlers.go:249`), reachable as `POST /api/upsnap/init-superuser`. The vulnerable code lacks any authentication, setup token, IP allow-list, or rate limit and is gated only by a `totalSuperusers > 0` count check — a conditio…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-49481] UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability …

UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the wake_cmd and shutdown_cmd templates and executed via /bin/sh -c (Linux) or cmd /C (Windows) without sani…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-16695] IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 could allow a local attacker to execute arbit…

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-13476] IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute ar…

IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary commands with service account privileges on the system due to improper validation of user supplied input.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-63298] An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration …

An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execut…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-17417] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary comman…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-17642] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary comman…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-12005] IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 …

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a input validation vulnerability in the management interface that allows already privileged attackers to execute additional operations by crafting a malicious HTTP request.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-18235] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Contro…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language commands due to insufficient input validation.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-17248] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of servic…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an OS command.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-16956] IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands d…

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

nvdcriticovulnerabilidad CVSS 9.8 NVD