Alertas de Seguridad de la Información

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54279] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, hos…

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54280] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, pay…

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is…

nvdaltovulnerabilidad CVSS 7.5 NVD

E Alto vulnerabilidad

22/06/2026

[CVE-2026-54283] Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts ma…

Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields…

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

22/06/2026

[CVE-2026-54271] protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.3.2 and 2.5.0, a previous fix …

protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.3.2 and 2.5.0, a previous fix for unsafe name handling in pbjs static / static-module code generation was incomplete. Affected versions of protobufjs-cli could still emit unsafe JavaScript references when generating static output from crafted JSON descriptor input. The common case of parsing schemas from .proto files is not affe…

nvdaltovulnerabilidad CVSS 8.2 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54273] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no …

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54274] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if …

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

F Alto vulnerabilidad

22/06/2026

[CVE-2026-53539] Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing applicati…

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no &, every fi…

nvdaltovulnerabilidad CVSS 7.5 NVD

V Alto vulnerabilidad

22/06/2026

[CVE-2026-53571] Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents…

Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS A…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-50168] Angular is a development platform for building mobile and desktop web applications using TypeScript/…

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/platform-server package allows remote attackers to bypass host allowlist constraints and direct server-side outgoing requests to arbitrary external endpoints. This occurs due to a parser dif…

nvdaltovulnerabilidad CVSS 8.2 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-50170] Angular is a development platform for building mobile and desktop web applications using TypeScript/…

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a vulnerability was discovered in @angular/common when Server-Side Rendering (SSR) and hydration are enabled. The HttpTransferCache utility optimizes hydration by caching outgoing HTTP requests performed during SSR …

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-50269] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, att…

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may b…

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

22/06/2026

[CVE-2026-48712] protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, p…

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf.Any JSON conversion path. A crafted protobuf binary payload containing deeply nested Any values could cause the JavaS…

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

22/06/2026

[CVE-2026-42127] The public dashboard query endpoint does not limit request body size before processing, allowing una…

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

22/06/2026

[CVE-2026-12249] An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Director…

An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate Services (AD CS) certificate auto-enrollment via the vendored Samba client script (internal/policies/certificate/python/vendor_samba/gp/gp_cert_auto_enroll_ext.py), ADSys utilizes a plaintext HTTP connection (http://) instead of a secure HTTPS connection (https://) to request the CA ce…

nvdcriticovulnerabilidad CVSS 9.0 NVD

A Crítico vulnerabilidad

22/06/2026

[CVE-2026-10789] A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the M…

A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user.

nvdcriticovulnerabilidad CVSS 9.6 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-9006] IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) wi…

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure.

nvdaltovulnerabilidad CVSS 7.4 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-9071] IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.…

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-9072] IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intellige…

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intelligent Management with the WebSphere WebServer Plug-in component - are vulnerable to remote code execution and denial of service. This vulnerability can be exploited when an attacker impersonates backend servers and sends crafted responses to the plug-in.

nvdaltovulnerabilidad CVSS 8.1 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-8646] IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3…

IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowing the attacker to bypass security controls, spoof identity, escalate privilege, and expose sensitive information.

nvdaltovulnerabilidad CVSS 7.4 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-8858] IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remo…

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote code execution and denial of service in the WebSphere Web Server Plug-in component. This vulnerability can be exploited when an attacker impersonates the application server and sends crafted responses to the plug-in.

nvdaltovulnerabilidad CVSS 7.5 NVD