Alertas de Seguridad de la Información

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53822] OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could …

OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could change between approval and execution. Attackers can rebuild command arguments after allowlist approval to execute unapproved command shapes, potentially bypassing security controls.

nvdaltovulnerabilidad CVSS 8.8 NVD

K Alto vulnerabilidad

12/06/2026

[CVE-2026-42850] Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject …

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is possible to inject commands within the subshell through kitty error. A special escape code will make kitty return an error, this error is not escaped and will be correctly echoed back to the terminal with CRLF, as such it will be run by the shell in use. To exploit this bug, the victim must use a netcat or a similar p…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46529] Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A si…

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PD…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-45558] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints (POST /api/service/haproxy//section/ and the PUT / global / defaults variants) accept a JSON option field that is not validated, not escaped, and is rendered verbatim into the generated HAProxy configuration via the sectio…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-11572] Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command In…

Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of user input for git shell commands directly invoked with exec() method by _cloneWithGit() and fetchRefs() functions. An attacker can execute arbitrary operating system commands as the process user by supplying a specially crafted git repository name.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11556] A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWrit…

A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWriteFacMac of the file /goform/WriteFacMac of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

07/06/2026

[CVE-2026-11451] A flaw has been found in GL.iNet GL-MT3000 4.4.5. This impacts the function snprintf of the file /cg…

A flaw has been found in GL.iNet GL-MT3000 4.4.5. This impacts the function snprintf of the file /cgi-bin/glc of the component FTP Protocol Handler. Executing a manipulation of the argument media_dir can lead to command injection. It is possible to launch the attack remotely. Upgrading to version 4.8.1 will fix this issue. You should upgrade the affected component. The vendor explains: "In version…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/06/2026

[CVE-2026-11452] A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function FUN_0042e2…

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function FUN_0042e200 of the file /cgi-bin/glc of the component SET_USER_PWD Handler. The manipulation of the argument Password leads to command injection. The attack can be initiated remotely. Upgrading to version 4.8.1 is able to address this issue. The affected component should be upgraded. The vendor explains: " T…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/06/2026

[CVE-2026-11450] A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the lib…

A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the library /usr/lib/oui-httpd/rpc/ of the component Path Normalization Handler. Performing a manipulation of the argument dev_name results in command injection. It is possible to initiate the attack remotely. Upgrading to version 4.7 mitigates this issue. It is advisable to upgrade the affected component.…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10872] A vulnerability was found in Shibby Tomato 1.28.0000. This issue affects the function start_vpnserve…

A vulnerability was found in Shibby Tomato 1.28.0000. This issue affects the function start_vpnserver of the file /sbin/rc of the component Web UI. Performing a manipulation results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used. This project is superseded by FreshTomato.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10873] A vulnerability was determined in Shibby Tomato 1.28.0000. Impacted is the function rstats_path of t…

A vulnerability was determined in Shibby Tomato 1.28.0000. Impacted is the function rstats_path of the file /bin/rstats of the component Web UI. Executing a manipulation can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This project is superseded by FreshTomato.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10871] A vulnerability has been found in Shibby Tomato 1.28.0000. This vulnerability affects the function s…

A vulnerability has been found in Shibby Tomato 1.28.0000. This vulnerability affects the function start_6rd_tunnel of the file /sbin/rc of the component Web UI. Such manipulation of the argument ipv6_6rd_borderrelay leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This project is superseded by FreshTomato.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10870] A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file …

A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file /sbin/rc of the component Web UI. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This project is superseded by FreshTomato.

nvdaltovulnerabilidad CVSS 7.2 NVD

P Crítico vulnerabilidad

04/06/2026

[CVE-2026-8037] OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an u…

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

nvdcriticovulnerabilidad CVSS 9.6 NVD