Alertas de Seguridad de la Información

O Alto vulnerabilidad

10/07/2026

[CVE-2026-52747] ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS …

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST because src/request_body_processor/multipart.cc overwrites reserved bytes in m_reserve instead o…

nvdaltovulnerabilidad CVSS 8.6 NVD

I Alto vulnerabilidad

08/07/2026

[CVE-2026-3144] IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to …

IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application before the system enforces a credential update.

nvdaltovulnerabilidad CVSS 8.1 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2026-11541] IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Se…

IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.

nvdaltovulnerabilidad CVSS 7.4 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2025-36359] IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expirati…

IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could allow an authenticated user to impersonate another user on the system.

nvdaltovulnerabilidad CVSS 8.1 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2026-11594] IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in…

IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console.

nvdaltovulnerabilidad CVSS 8.5 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2026-13772] IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacke…

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at three distinct sinks (SELECT NEW, enum literals, and reflection-based comparators); an authenticated remote attacker who can influence an application-built OQL query string can execute arbitrary construct…

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2026-11714] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side re…

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled.

nvdaltovulnerabilidad CVSS 8.5 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2026-11806] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary fil…

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.

nvdaltovulnerabilidad CVSS 7.2 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2026-13449] IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external e…

IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

nvdaltovulnerabilidad CVSS 7.6 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2026-13759] IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObje…

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver) that install no JEP-290 class filter; when Coherence is on the classpath, multiple RCE gadget chains including RemoteConstructor.readResolve and PriorityQueue/ExtractorComparator are confirmed working, allowing a post-lo…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

30/06/2026

[CVE-2026-10546] IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in …

IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL component ( src/lfx/src/lfx/components/data_source/url.py ) due to a Time-of-Check/Time-of-Use (TOCTOU) race condition that can be exploited via DNS rebinding.

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

30/06/2026

[CVE-2026-10560] IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/buil…

IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/ endpoints that allows an unauthenticated attacker to read build event data or cancel jobs using a valid job identifier, resulting in information disclosure and denial of service.

nvdaltovulnerabilidad CVSS 8.2 NVD

L Alto vulnerabilidad

30/06/2026

[CVE-2026-10564] IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSRe…

IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSReaderComponent in rss.py and SearXNG component in searxng.py make unvalidated HTTP requests to user-controlled URLs, bypassing SSRF protections introduced in version 1.9.3. An authenticated attacker can exploit this to access internal resources including cloud metadata services (AWS/Azure/GCP IMDS), …

nvdaltovulnerabilidad CVSS 8.2 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2026-11546] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side re…

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

30/06/2026

[CVE-2026-10129] IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass…

IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass vulnerability in the API Request component. An authenticated attacker with low-level privileges (flow author role) can bypass SSRF protections by enabling the follow_redirects parameter and supplying a public URL that redirects to internal/localhost addresses. The vulnerability exists because the a…

nvdaltovulnerabilidad CVSS 8.5 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53234] In the Linux kernel, the following vulnerability has been resolved: net: ibm: emac: Fix use-after-f…

In the Linux kernel, the following vulnerability has been resolved: net: ibm: emac: Fix use-after-free during device removal The driver was using devm_register_netdev() which causes unregister_netdev() to be deferred until the devres cleanup phase, which runs after emac_remove() returns. This creates a use-after-free window where: 1. emac_remove() is called, which tears down hardware (cancels w…

nvdaltovulnerabilidad CVSS 7.8 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-9006] IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) wi…

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure.

nvdaltovulnerabilidad CVSS 7.4 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-9071] IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.…

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-9072] IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intellige…

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intelligent Management with the WebSphere WebServer Plug-in component - are vulnerable to remote code execution and denial of service. This vulnerability can be exploited when an attacker impersonates backend servers and sends crafted responses to the plug-in.

nvdaltovulnerabilidad CVSS 8.1 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-8646] IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3…

IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowing the attacker to bypass security controls, spoof identity, escalate privilege, and expose sensitive information.

nvdaltovulnerabilidad CVSS 7.4 NVD