Alertas de Seguridad de la Información

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72875] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, settings.readTraefi…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, settings.readTraefikFile in apps/dokploy/server/api/routers/settings.ts passes a path accepted by apiReadTraefikConfig to readConfigInPath in packages/server/src/utils/traefik/application.ts, where configPath is interpolated into execAsyncRemote as cat ${configPath}, allowing a user with traefikFiles.read permission t…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72876] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, swarm.getNodes, swa…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in apps/dokploy/server/api/routers/swarm.ts accept another organization’s serverId without an activeOrganizationId ownership check, and getNodeInfo in packages/server/src/services/docker.ts interpolates nodeId into execAsyncRemote, allowing a …

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-71966] CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability…

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands through a crafted directory name in the remote server's API response, which bypasses security middleware …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72872] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.saveBit…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clone commands executed through execAsync or execAsyncRemote, allowing a member with service deployment …

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72865] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the compose.update …

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the compose.update operation stores an unvalidated composePath that packages/server/src/utils/builders/compose.ts and packages/server/src/services/compose.ts interpolate into docker compose -f, docker stack deploy -c, and touch shell commands executed through /bin/sh -c. An authenticated member with compose write and …

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72867] Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomp…

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trig…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72868] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, apps/dokploy/server…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, secretAccessKey, region, endpoint, provider, and bucket fields from destination.testConnection into an rclone ls command executed through child_process.exec. The `withPermission("destination", "create")` path permits a low-privileged organizati…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72869] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreB…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription passes the databaseName parameter to restore builders in packages/server/src/utils/restore/utils.ts, where PostgreSQL, MariaDB, MySQL, and MongoDB commands embed the value in nested shell text executed by Node.js exec. An authenticated user with backup:restore permiss…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72862] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the mariadb.ts, mon…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts Dokploy database service deployment functions pass user-controlled dockerImage fields unquoted into docker pull ${dockerImage} shell commands on the remote-server code path. This vulnerability is fixed in 0.29.13.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72738] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.listBack…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/backup.ts passes the search parameter through normalizeS3Path and interpolates it into an rclone lsjson command executed by child_process.exec(), allowing an authenticated user with backup:read permission to execute arbitrary commands on the D…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72740] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, packages/server/src…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting, allowing an authenticated member with service deployment permission and an attached SSH key to exec…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72733] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreB…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax. packages/server/src/utils/restore/utils.ts interpolates databaseName into database-specific restore commands, while pa…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-13206] Improper neutralization of special elements used in an OS command ('OS command injection') vulnerabi…

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Zyxel Networks WAH7601 allows OS Command Injection. This issue affects WAH7601: through 20072026.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/08/2026

Vulnerabilidad crítica de inyección de comandos OS en crontab-ui permite ejecución remota sin autenticación

crontab-ui versión 0.4.2 y anteriores contiene una vulnerabilidad de inyección de comandos del sistema operativo (CVSS 9.8) que permite a atacantes remotos no autenticados ejecutar comandos arbitrarios mediante la importación de archivos de base de datos .db manipulados en el endpoint POST /import. El endpoint acepta archivos sin validación y sobrescribe la base de datos de la aplicación, afectando potencialmente servidores de producción en infraestructuras críticas de empresas en México y Latinoamérica que utilizan esta herramienta para gestión de tareas programadas.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

10/08/2026

Inyección de comandos OS en pm2panel (todas las versiones) permite ejecución remota de código

Una vulnerabilidad alta en pm2panel permite a atacantes autenticados ejecutar comandos arbitrarios en el sistema operativo del servidor sin validación de entrada. El parámetro req.query.id se pasa directamente a funciones exec() sin sanitización, permitiendo encadenamiento de comandos mediante caracteres especiales de shell. Afecta a sistemas de gestión de procesos en infraestructuras DevOps y hosting en la región.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72579] An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attack…

An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

10/08/2026

Inyección de comandos OS en xiaoai-patch permite ejecución remota en altavoces Xiaomi

Una vulnerabilidad crítica (CVSS 9.8) en xiaoai-patch afecta altavoces inteligentes Xiaomi permitiendo a atacantes remotos ejecutar comandos del sistema operativo arbitrarios. Los endpoints /mute y /unmute en api/main.py no sanitizan el parámetro silent, facilitando inyección de comandos vía metacaracteres de shell. En LATAM, esto representa riesgo para hogares inteligentes y ambientes corporativos que usen estos dispositivos.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-19379] A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the …

A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

09/08/2026

Vulnerabilidad crítica de inyección de comandos en router MSI Radix AXE6600 (CVE-2026-71990)

El firmware v781521 del router MSI Radix AXE6600 contiene una vulnerabilidad de inyección de comandos en la función TelnetSSH que permite a atacantes remotos ejecutar comandos arbitrarios y obtener privilegios root. Afecta principalmente a empresas en LATAM que utilizan estos equipos como puntos de acceso corporativo o puntos de convergencia de red. La explotación no requiere autenticación previa, facilitando ataques desde Internet público.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

09/08/2026

Vulnerabilidad crítica de inyección de comandos en router MSI Radix AXE6600 (CVE-2026-71991)

El firmware v781521 del router MSI Radix AXE6600 contiene una vulnerabilidad de inyección de comandos en la función TelnetSSH que permite a atacantes remotos ejecutar comandos arbitrarios y obtener privilegios root. Esta falla afecta directamente a empresas en LATAM que usan este equipamiento en infraestructuras de red crítica, perímetro corporativo o conexiones de sucursales. El CVSS 9.8 indica riesgo crítico con alta probabilidad de explotación remota sin autenticación.

nvdcriticovulnerabilidad CVSS 9.8 NVD