Alertas de Seguridad de la Información

I Alto vulnerabilidad

30/06/2026

[CVE-2026-11714] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side re…

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled.

nvdaltovulnerabilidad CVSS 8.5 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2026-11806] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary fil…

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.

nvdaltovulnerabilidad CVSS 7.2 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2026-13449] IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external e…

IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

nvdaltovulnerabilidad CVSS 7.6 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2026-13759] IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObje…

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver) that install no JEP-290 class filter; when Coherence is on the classpath, multiple RCE gadget chains including RemoteConstructor.readResolve and PriorityQueue/ExtractorComparator are confirmed working, allowing a post-lo…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Crítico vulnerabilidad

30/06/2026

[CVE-2026-10140] IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows…

IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to be processed using incorrect upstream API credentials, leading to cross-tenant billing and accountability misattribution.

nvdcriticovulnerabilidad CVSS 9.6 NVD

L Alto vulnerabilidad

30/06/2026

[CVE-2026-10546] IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in …

IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL component ( src/lfx/src/lfx/components/data_source/url.py ) due to a Time-of-Check/Time-of-Use (TOCTOU) race condition that can be exploited via DNS rebinding.

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

30/06/2026

[CVE-2026-10560] IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/buil…

IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/ endpoints that allows an unauthenticated attacker to read build event data or cancel jobs using a valid job identifier, resulting in information disclosure and denial of service.

nvdaltovulnerabilidad CVSS 8.2 NVD

L Alto vulnerabilidad

30/06/2026

[CVE-2026-10564] IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSRe…

IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSReaderComponent in rss.py and SearXNG component in searxng.py make unvalidated HTTP requests to user-controlled URLs, bypassing SSRF protections introduced in version 1.9.3. An authenticated attacker can exploit this to access internal resources including cloud metadata services (AWS/Azure/GCP IMDS), …

nvdaltovulnerabilidad CVSS 8.2 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2026-11546] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side re…

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.

nvdaltovulnerabilidad CVSS 7.1 NVD

I Crítico vulnerabilidad

30/06/2026

[CVE-2026-11708] IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in…

IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system.

nvdcriticovulnerabilidad CVSS 9.3 NVD

I Crítico vulnerabilidad

30/06/2026

[CVE-2026-11712] IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in…

IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system.

nvdcriticovulnerabilidad CVSS 9.3 NVD

I Crítico vulnerabilidad

30/06/2026

[CVE-2026-10109] IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due …

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling.

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

30/06/2026

[CVE-2026-10129] IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass…

IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass vulnerability in the API Request component. An authenticated attacker with low-level privileges (flow author role) can bypass SSRF protections by enabling the follow_redirects parameter and supplying a public URL that redirects to internal/localhost addresses. The vulnerability exists because the a…

nvdaltovulnerabilidad CVSS 8.5 NVD

L Crítico vulnerabilidad

30/06/2026

[CVE-2026-10134] IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langfl…

IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read and modify every flow, conversation, message, file upload, and saved component in the Langflow database, can connect to internal services, abuse cloud metadata endpoints, laterally move to other tenants on the same Langflow instance, and Establish persistence by modifying the public…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-58138] Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerabilit…

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-10513] The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to a…

The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.8.0 via parser-derived 'avatar' and 'url' author metadata. This is due to insufficient input sanitization and output escaping on user-supplied MF2 author properties processed by the unauthenticated webmention REST endpoint and rendered directly into HTML 'value' attributes by the edit…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-58377] JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low…

JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low-privilege users to perform full create, read, update, and delete operations on OpenAPI credentials by accessing the OpenApiAuthController and OpenApiPermissionController endpoints which lack Shiro authorization annotations. Attackers can exploit the unenforced access controls to list, add, edit, an…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-58372] SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObject…

SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObjectsHandler that allows authenticated S3 principals with write access to a single bucket to delete arbitrary objects in other tenants' buckets by supplying object keys containing ../ sequences in the DeleteObjects XML request body. Attackers can bypass authorization controls through a confused deputy c…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-58375] JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the…

JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTokenInterceptor skips all authentication and authorization, and the export service streams the rendered report for any supplied report id without verifying the auto-export configuration flag. An unauthenticated remote attacker can enumerate S…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-58376] Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows…

Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows authenticated API users to exfiltrate arbitrary database contents by supplying malicious values to the sqlfilters query parameter in the setup dictionary and multicurrencies REST API endpoints. The affected endpoints in api_setup.class.php and api_multicurrencies.class.php validate sqlfilters only …

nvdaltovulnerabilidad CVSS 7.6 NVD