Alertas de Seguridad de la Información

L Crítico vulnerabilidad

30/06/2026

[CVE-2026-7873] IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS command…

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.

nvdcriticovulnerabilidad CVSS 9.9 NVD

L Crítico vulnerabilidad

30/06/2026

[CVE-2026-7874] IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due …

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due to the use of a weak and reversible key derivation mechanism for encryption at rest.

nvdcriticovulnerabilidad CVSS 9.1 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2026-13772] IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacke…

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at three distinct sinks (SELECT NEW, enum literals, and reflection-based comparators); an authenticated remote attacker who can influence an application-built OQL query string can execute arbitrary construct…

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2026-11714] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side re…

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled.

nvdaltovulnerabilidad CVSS 8.5 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2026-11806] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary fil…

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.

nvdaltovulnerabilidad CVSS 7.2 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2026-13449] IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external e…

IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

nvdaltovulnerabilidad CVSS 7.6 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2026-13759] IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObje…

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver) that install no JEP-290 class filter; when Coherence is on the classpath, multiple RCE gadget chains including RemoteConstructor.readResolve and PriorityQueue/ExtractorComparator are confirmed working, allowing a post-lo…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Crítico vulnerabilidad

30/06/2026

[CVE-2026-10140] IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows…

IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to be processed using incorrect upstream API credentials, leading to cross-tenant billing and accountability misattribution.

nvdcriticovulnerabilidad CVSS 9.6 NVD

L Alto vulnerabilidad

30/06/2026

[CVE-2026-10546] IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in …

IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL component ( src/lfx/src/lfx/components/data_source/url.py ) due to a Time-of-Check/Time-of-Use (TOCTOU) race condition that can be exploited via DNS rebinding.

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

30/06/2026

[CVE-2026-10560] IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/buil…

IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/ endpoints that allows an unauthenticated attacker to read build event data or cancel jobs using a valid job identifier, resulting in information disclosure and denial of service.

nvdaltovulnerabilidad CVSS 8.2 NVD

L Alto vulnerabilidad

30/06/2026

[CVE-2026-10564] IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSRe…

IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSReaderComponent in rss.py and SearXNG component in searxng.py make unvalidated HTTP requests to user-controlled URLs, bypassing SSRF protections introduced in version 1.9.3. An authenticated attacker can exploit this to access internal resources including cloud metadata services (AWS/Azure/GCP IMDS), …

nvdaltovulnerabilidad CVSS 8.2 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2026-11546] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side re…

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.

nvdaltovulnerabilidad CVSS 7.1 NVD

I Crítico vulnerabilidad

30/06/2026

[CVE-2026-11708] IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in…

IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system.

nvdcriticovulnerabilidad CVSS 9.3 NVD

I Crítico vulnerabilidad

30/06/2026

[CVE-2026-11712] IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in…

IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system.

nvdcriticovulnerabilidad CVSS 9.3 NVD

I Crítico vulnerabilidad

30/06/2026

[CVE-2026-10109] IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due …

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling.

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

30/06/2026

[CVE-2026-10129] IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass…

IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass vulnerability in the API Request component. An authenticated attacker with low-level privileges (flow author role) can bypass SSRF protections by enabling the follow_redirects parameter and supplying a public URL that redirects to internal/localhost addresses. The vulnerability exists because the a…

nvdaltovulnerabilidad CVSS 8.5 NVD

L Crítico vulnerabilidad

30/06/2026

[CVE-2026-10134] IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langfl…

IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read and modify every flow, conversation, message, file upload, and saved component in the Langflow database, can connect to internal services, abuse cloud metadata endpoints, laterally move to other tenants on the same Langflow instance, and Establish persistence by modifying the public…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-58138] Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerabilit…

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-10513] The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to a…

The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.8.0 via parser-derived 'avatar' and 'url' author metadata. This is due to insufficient input sanitization and output escaping on user-supplied MF2 author properties processed by the unauthenticated webmention REST endpoint and rendered directly into HTML 'value' attributes by the edit…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-58377] JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low…

JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low-privilege users to perform full create, read, update, and delete operations on OpenAPI credentials by accessing the OpenApiAuthController and OpenApiPermissionController endpoints which lack Shiro authorization annotations. Attackers can exploit the unenforced access controls to list, add, edit, an…

nvdaltovulnerabilidad CVSS 8.1 NVD