Alertas de Seguridad de la Información

A Alto vulnerabilidad

22/06/2026

[CVE-2026-50168] Angular is a development platform for building mobile and desktop web applications using TypeScript/…

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/platform-server package allows remote attackers to bypass host allowlist constraints and direct server-side outgoing requests to arbitrary external endpoints. This occurs due to a parser dif…

nvdaltovulnerabilidad CVSS 8.2 NVD

G Alto vulnerabilidad

22/06/2026

[CVE-2026-42127] The public dashboard query endpoint does not limit request body size before processing, allowing una…

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

22/06/2026

[CVE-2026-12249] An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Director…

An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate Services (AD CS) certificate auto-enrollment via the vendored Samba client script (internal/policies/certificate/python/vendor_samba/gp/gp_cert_auto_enroll_ext.py), ADSys utilizes a plaintext HTTP connection (http://) instead of a secure HTTPS connection (https://) to request the CA ce…

nvdcriticovulnerabilidad CVSS 9.0 NVD

A Crítico vulnerabilidad

22/06/2026

[CVE-2026-10789] A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the M…

A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user.

nvdcriticovulnerabilidad CVSS 9.6 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-9006] IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) wi…

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure.

nvdaltovulnerabilidad CVSS 7.4 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-9071] IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.…

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-9072] IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intellige…

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intelligent Management with the WebSphere WebServer Plug-in component - are vulnerable to remote code execution and denial of service. This vulnerability can be exploited when an attacker impersonates backend servers and sends crafted responses to the plug-in.

nvdaltovulnerabilidad CVSS 8.1 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-8646] IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3…

IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowing the attacker to bypass security controls, spoof identity, escalate privilege, and expose sensitive information.

nvdaltovulnerabilidad CVSS 7.4 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-8858] IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remo…

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote code execution and denial of service in the WebSphere Web Server Plug-in component. This vulnerability can be exploited when an attacker impersonates the application server and sends crafted responses to the plug-in.

nvdaltovulnerabilidad CVSS 7.5 NVD

L Crítico vulnerabilidad

22/06/2026

[CVE-2026-7664] IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP p…

IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-56104] Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attack…

Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the restore_existing_session path to assume a victim's permissions and roles, enabling unauthorized invocation of tools an…

nvdaltovulnerabilidad CVSS 8.2 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54268] Angular is a development platform for building mobile and desktop web applications using TypeScript/…

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the len…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-50178] The Angular Language Service VS Code Extension provides a rich editing experience for Angular templa…

The Angular Language Service VS Code Extension provides a rich editing experience for Angular templates. the client-side Angular Language Service VS Code extension configures the tooltip Markdown renderer with the isTrusted: true option (located in client/src/client.ts). This setting instructs VS Code to trust all rendered content it receives, which enables active elements such as command: URIs. H…

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-49241] The Angular Language Service VS Code Extension provides a rich editing experience for Angular templa…

The Angular Language Service VS Code Extension provides a rich editing experience for Angular templates. Prior to 21.2.4, the client-side Angular Language Service VS Code extension reads the custom TypeScript SDK paths typescript.tsdk and js/ts.tsdk.path directly from workspace configurations (.vscode/settings.json) without verifying VS Code Workspace Trust state or asking for user consent (locate…

nvdaltovulnerabilidad CVSS 8.8 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-10845] IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication …

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications.

nvdaltovulnerabilidad CVSS 7.3 NVD

G Alto vulnerabilidad

22/06/2026

[CVE-2026-9029] A user with Editor permissions can place a malicious script in the attribution field of a Geomap pan…

A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).

nvdaltovulnerabilidad CVSS 7.3 NVD

X Crítico vulnerabilidad

22/06/2026

[CVE-2026-6653] Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allow…

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-56425] The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its …

The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to bypass important security guarantees provided by the protocol. The application used the PHP session identifier (session_id()) as the OAuth state parameter. Because session identifiers are long-lived authentication credentials, exposing the…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-56447] MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbit…

MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path. MISP subsequently parsed the referenced INI file and passed its options to rdkafka. A crafted attacker-controlled configuration file could use rdkafka options such as plugin.library.paths to load an external library, resulting in arbitrary code execution with the privileges of …

nvdaltovulnerabilidad CVSS 7.2 NVD

L Crítico vulnerabilidad

22/06/2026

[CVE-2026-10561] IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python exe…

IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with an authentication bypass that allows an unauthenticated attacker to execute arbitrary code on the host system, resulting in complete compromise

nvdcriticovulnerabilidad CVSS 10.0 NVD