Alertas de Seguridad de la Información

M Alto vulnerabilidad

17/07/2026

[CVE-2026-9171] IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial…

IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-58195] Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools i…

Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated.ts, src/mcp/fastmcp/servers/http-sse.ts, src/mcp/fastmcp/servers/poc-stdio.ts, src/mcp/fastmcp/tools/agent/{execute,list,parallel}.ts, src/…

nvdaltovulnerabilidad CVSS 8.8 NVD

J Alto vulnerabilidad

17/07/2026

[CVE-2026-52746] JSONata is a JSON query and transformation language. Prior to 2.2.0, malicious non-matching inputs t…

JSONata is a JSON query and transformation language. Prior to 2.2.0, malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service in applications that evaluate user-provided JSONata expressions. This issue is fixed in version 2.2.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-45162] Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, …

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data from database columns and filesystem files without the allowed_classes restriction, including lib/Tool/Authentication.php, models/Site/Dao.php, models/DataObject/ClassDefinition/CustomLayout/Dao.php, models/Tool/TmpStore/Dao.php, models/Ass…

nvdaltovulnerabilidad CVSS 8.0 NVD

A Alto vulnerabilidad

17/07/2026

[CVE-2026-45309] AsyncSSH is a Python package which provides an asynchronous client and server implementation of the …

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py, asyncssh/auth_keys.py, and asyncssh/misc.py with the raw SSH username during pre-authentication server config rel…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Crítico vulnerabilidad

17/07/2026

[CVE-2026-9198] IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (…

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

17/07/2026

[CVE-2026-9202] IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user acco…

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow instance; when NEW_USER_IS_ACTIVE=true (documented deployment option), newly created accounts are immediately active and can authenticate to reach RCE endpoints, bypassing the need for AUTO_LOGIN.

nvdcriticovulnerabilidad CVSS 9.8 NVD

I Alto vulnerabilidad

17/07/2026

[CVE-2026-9762] IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when…

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-50273] Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Data…

Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction, allowing a remote unauthenticated attacker to send a baggage header with many comma-separated key-value pairs or …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-63101] Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthe…

Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attackers to export the complete member roster of any group, including email addresses, names, join dates, and roles, by submitting requests to the group followers CSV export endpoint which lacks any authentication decorator. Attackers can enumerate sequential group IDs via brute-force, tri…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-8297] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: from 1.4.03 through 08072026.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-54496] ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad 5.0.0, halo2_gadgets 0.5.0, orchard …

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad 5.0.0, halo2_gadgets 0.5.0, orchard 0.14.0, zcash_primitives 0.28.0, and zcashd 6.20.0, the variable-base scalar multiplication gadget in halo2_gadgets/src/ecc/chip/mul/incomplete.rs used assign_advice() for the base point without a copy constraint tying it to the actual base, allowing a malicious prover to produce a valid proof for a…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-57860] ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the M…

ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and args values (for example, command: bash with args: ['-c', 'touch /tmp/pwned']). When a user runs the …

nvdaltovulnerabilidad CVSS 7.8 NVD

S Alto vulnerabilidad

17/07/2026

[CVE-2026-49211] Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Auto…

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause() builds the LIKE expression used by the autocomplete endpoint by wrapping the client-supplied query in %...% without escaping SQL LIKE wildcards (%, _, \), allowing unauthenticated users to turn the public BaseEntityAutocompleteType endpoint into …

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

17/07/2026

[CVE-2026-49212] Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC comput…

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\UX\LiveComponent\LiveComponentHydrator covered only sorted prop key/value pairs and did not include the component name, the slot identifier (props vs propsFromParent), or request context, allowing a signed blob minted for one component or slot to be replayed in another and set a read-o…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-12691] Missing authentication for critical function vulnerability in Vimesoft Inc. Enterprise Video Platfor…

Missing authentication for critical function vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-12692] Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentic…

Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-12693] Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Pla…

Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-12694] Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Func…

Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-60024] Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0 - The Jo…

Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 did by default allow unauthenticated users to upload media assets.

nvdcriticovulnerabilidad CVSS 9.8 NVD