Alertas de Seguridad de la Información

A Alto vulnerabilidad

22/06/2026

[CVE-2026-50170] Angular is a development platform for building mobile and desktop web applications using TypeScript/…

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a vulnerability was discovered in @angular/common when Server-Side Rendering (SSR) and hydration are enabled. The HttpTransferCache utility optimizes hydration by caching outgoing HTTP requests performed during SSR …

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-50269] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, att…

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may b…

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

22/06/2026

[CVE-2026-42127] The public dashboard query endpoint does not limit request body size before processing, allowing una…

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

22/06/2026

[CVE-2026-12249] An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Director…

An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate Services (AD CS) certificate auto-enrollment via the vendored Samba client script (internal/policies/certificate/python/vendor_samba/gp/gp_cert_auto_enroll_ext.py), ADSys utilizes a plaintext HTTP connection (http://) instead of a secure HTTPS connection (https://) to request the CA ce…

nvdcriticovulnerabilidad CVSS 9.0 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-9006] IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) wi…

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure.

nvdaltovulnerabilidad CVSS 7.4 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-9071] IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.…

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-8646] IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3…

IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowing the attacker to bypass security controls, spoof identity, escalate privilege, and expose sensitive information.

nvdaltovulnerabilidad CVSS 7.4 NVD

R Alto vulnerabilidad

22/06/2026

[CVE-2026-54099] A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platf…

A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validates that a Certificate Signing Request contains the organization system:wicd-nodes but does not reject additional organization values such as system:masters. A compromised Windows worker node that holds WICD credentials can submit a CSR that is auto-approved and…

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-44914] Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that includ…

Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required, but framework authorization did not check restricted status when handling requests to replace Process Groups. The missing authorization pe…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

21/06/2026

[CVE-2026-12806] A vulnerability has been found in Edimax BR-6478AC V2 1.23. The impacted element is the function for…

A vulnerability has been found in Edimax BR-6478AC V2 1.23. The impacted element is the function formWlSiteSurvey of the file /goform/formWlSiteSurvey of the component POST Request Handler. The manipulation of the argument selSSID leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early ab…

nvdaltovulnerabilidad CVSS 8.8 NVD

V Alto vulnerabilidad

20/06/2026

[CVE-2026-56340] vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings p…

vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submit crafted embedding requests with malformed (negative or out-of-bounds) tensor indices, when the prompt-embeds feature is enabled, to trigger crashes or resource exhaustion (denial of service), with p…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

20/06/2026

[CVE-2026-56341] AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plu…

AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attackers can retrieve all payment transaction data including agreement IDs, user financial records, and API responses via direct GET requests to vulnerable endpoints.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

20/06/2026

[CVE-2020-37255] WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows un…

WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by sending a crafted POST request with the IWP_JSON_PREFIX header. Attackers can exploit this flaw to obtain valid administrator session cookies and access the WordPress dashboard without providing credentials.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

20/06/2026

[CVE-2022-50972] WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute ar…

WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. Attackers can send requests to the class-wc-meta-box-product-images.php endpoint with unsanitized product-type values to write malicious PHP files to the web root.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

20/06/2026

[CVE-2019-25763] WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability…

WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attackers to gain unauthorized access by exploiting the social media login form functionality. Attackers can submit a POST request to the admin-ajax.php endpoint with the uabb-lf-google-submit action, a valid administrator email address, and a valid nonce to obtain session cookies and a…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/06/2026

[CVE-2026-56073] Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allo…

Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying server responses. Attackers can intercept OTP verification requests and manipulate HTTP responses to falsely mark verification successful, enabling unauthorized 2FA enablement and account takeover.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-49291] mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTT…

mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTTP MCP JSON-RPC endpoint at `/mcp` requires only OAuth `read` scope for all requests, then dispatches `tools/call` directly to handlers that include mutating tools. A read-only OAuth client can call `store_memory` and `delete_memory` through MCP even though the corresponding REST endpoints require `w…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2023-54357] Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unau…

Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploiting the getUserData function in the customer controller. Attackers can send GET requests to index.php with option=com_booking, controller=customer, task=getUserData, and an id parameter to retrieve user names, usernames, and email addresses …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2019-25761] Joomla! Component JoomCRM 1.1.1 contains an SQL injection vulnerability that allows authenticated at…

Joomla! Component JoomCRM 1.1.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the deal_id parameter. Attackers can send GET requests to index.php with option=com_joomcrm&view=contacts and inject SQL code in the deal_id parameter to extract sensitive database information including table names and sche…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2019-25762] Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows u…

Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive user data by exploiting the projects endpoint. Attackers can send requests to index.php with option=com_jpprojects&view=projects&tmpl=component&format=json parameters to retrieve user IDs, names, and email addresses in JSON format.

nvdaltovulnerabilidad CVSS 7.5 NVD