Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 50 min
Buscando: "Ibm" — 150 resultados ✕ Limpiar búsqueda
22,162
Total alertas
4698
Críticas
16876
Altas
8
Ransomware
1037
Esta semana
RSS
Crítica × Limpiar todo ×
M Crítico vulnerabilidad
28/07/2026
[CVE-2026-14958] IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute ar…
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
28/07/2026
[CVE-2026-14959] IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute ar…
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
28/07/2026
[CVE-2026-14973] IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written out…
IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
28/07/2026
[CVE-2026-14446] IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escal…
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
28/07/2026
[CVE-2026-14512] IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe…
IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.
nvdcriticovulnerabilidad CVSS 9.8 NVD
L Crítico vulnerabilidad
17/07/2026
[CVE-2026-13446] IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptog…
IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
nvdcriticovulnerabilidad CVSS 9.8 NVD
L Crítico vulnerabilidad
17/07/2026
[CVE-2026-8505] IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic…
IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False (which is the default setting). This allows a remote attacker who knows a flow's UUID to execute it as if they were the ow…
nvdcriticovulnerabilidad CVSS 9.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
L Crítico vulnerabilidad
17/07/2026
[CVE-2026-8635] IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser…
IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.
nvdcriticovulnerabilidad CVSS 9.9 NVD
L Crítico vulnerabilidad
17/07/2026
[CVE-2026-8859] IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to u…
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to unintended locations due to improper input validation in the APIRequest component. A path traversal vulnerability exists when the "Save to File" feature is enabled, where filenames extracted from HTTP response Content-Disposition headers are not sanitized before being joined to the temporary director…
nvdcriticovulnerabilidad CVSS 9.9 NVD
L Crítico vulnerabilidad
17/07/2026
[CVE-2026-8476] IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the …
IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads() function to deserialize cached objects from disk without validation, integrity verification, or authentication, enabling arbitrary code execution when malicious pickle payloads are processed. Attackers who can…
nvdcriticovulnerabilidad CVSS 9.9 NVD
L Crítico vulnerabilidad
17/07/2026
[CVE-2026-8481] IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the …
IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec() function without sandboxing, input validation, or privilege restrictions, enabling any authenticated user to execute arbitrary system comman…
nvdcriticovulnerabilidad CVSS 9.9 NVD
I Crítico vulnerabilidad
17/07/2026
[CVE-2026-15091] IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary sc…
IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary scripts due to improper neutralization of input during web page generation.
nvdcriticovulnerabilidad CVSS 9.3 NVD
L Crítico vulnerabilidad
17/07/2026
[CVE-2026-9103] IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due …
IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/auto_login endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication when the AUTO_LOGIN configuration is enabled (enabled by default), which may allow an unauthenticated network attacker to obtain full administr…
nvdcriticovulnerabilidad CVSS 9.8 NVD
L Crítico vulnerabilidad
17/07/2026
[CVE-2026-9135] IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163…
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allow_custom_components=false security control. The vulnerability exists because the validation mechanism only checks the main component source code in node_template["code"]["…
nvdcriticovulnerabilidad CVSS 9.9 NVD
L Crítico vulnerabilidad
17/07/2026
[CVE-2026-9198] IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (…
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
L Crítico vulnerabilidad
17/07/2026
[CVE-2026-9202] IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user acco…
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow instance; when NEW_USER_IS_ACTIVE=true (documented deployment option), newly created accounts are immediately active and can authenticate to reach RCE endpoints, bypassing the need for AUTO_LOGIN.
nvdcriticovulnerabilidad CVSS 9.8 NVD
I Crítico vulnerabilidad
08/07/2026
[CVE-2026-9074] IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated …
IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.
nvdcriticovulnerabilidad CVSS 9.1 NVD
L Crítico vulnerabilidad
30/06/2026
[CVE-2026-7663] IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP p…
IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.
nvdcriticovulnerabilidad CVSS 9.1 NVD
L Crítico vulnerabilidad
30/06/2026
[CVE-2026-7803] IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validatio…
IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validation of flow nodes with missing or empty component type fields.
nvdcriticovulnerabilidad CVSS 9.8 NVD
L Crítico vulnerabilidad
30/06/2026
[CVE-2026-7871] IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with …
IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with full application privileges, compromising all secrets, data, and system integrity.
nvdcriticovulnerabilidad CVSS 9.8 NVD