Alertas de Seguridad de la Información

I Alto vulnerabilidad

22/06/2026

[CVE-2026-9006] IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) wi…

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure.

nvdaltovulnerabilidad CVSS 7.4 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-9071] IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.…

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-9072] IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intellige…

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intelligent Management with the WebSphere WebServer Plug-in component - are vulnerable to remote code execution and denial of service. This vulnerability can be exploited when an attacker impersonates backend servers and sends crafted responses to the plug-in.

nvdaltovulnerabilidad CVSS 8.1 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-8646] IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3…

IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowing the attacker to bypass security controls, spoof identity, escalate privilege, and expose sensitive information.

nvdaltovulnerabilidad CVSS 7.4 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-8858] IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remo…

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote code execution and denial of service in the WebSphere Web Server Plug-in component. This vulnerability can be exploited when an attacker impersonates the application server and sends crafted responses to the plug-in.

nvdaltovulnerabilidad CVSS 7.5 NVD

L Crítico vulnerabilidad

22/06/2026

[CVE-2026-7664] IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP p…

IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-56104] Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attack…

Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by presenting a valid sessionId during WebSocket session restoration without ownership verification. Attackers can exploit the restore_existing_session path to assume a victim's permissions and roles, enabling unauthorized invocation of tools an…

nvdaltovulnerabilidad CVSS 8.2 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54268] Angular is a development platform for building mobile and desktop web applications using TypeScript/…

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the len…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-50178] The Angular Language Service VS Code Extension provides a rich editing experience for Angular templa…

The Angular Language Service VS Code Extension provides a rich editing experience for Angular templates. the client-side Angular Language Service VS Code extension configures the tooltip Markdown renderer with the isTrusted: true option (located in client/src/client.ts). This setting instructs VS Code to trust all rendered content it receives, which enables active elements such as command: URIs. H…

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-49241] The Angular Language Service VS Code Extension provides a rich editing experience for Angular templa…

The Angular Language Service VS Code Extension provides a rich editing experience for Angular templates. Prior to 21.2.4, the client-side Angular Language Service VS Code extension reads the custom TypeScript SDK paths typescript.tsdk and js/ts.tsdk.path directly from workspace configurations (.vscode/settings.json) without verifying VS Code Workspace Trust state or asking for user consent (locate…

nvdaltovulnerabilidad CVSS 8.8 NVD

P Alto vulnerabilidad

22/06/2026

[CVE-2026-41046] A path traversal attack when using a "configName" parameter in qSnapper before version 1.3.3 allowed…

A path traversal attack when using a "configName" parameter in qSnapper before version 1.3.3 allowed a local attacker to use malicious config files for snapper and so cause a denial of service or potentially escalate privileges to root.

nvdaltovulnerabilidad CVSS 7.3 NVD

P Alto vulnerabilidad

22/06/2026

[CVE-2026-41048] Incorrect caching of authentication between different polkit methods in qSnapper before version 1.3.…

Incorrect caching of authentication between different polkit methods in qSnapper before version 1.3.3 allowed a local attacker to use functions like "restore from snapshot" even if only allowed to do "delete snapshot".

nvdaltovulnerabilidad CVSS 7.1 NVD

P Alto vulnerabilidad

22/06/2026

[CVE-2026-41049] Incorrect caching of authentication between different users of the  qSnapper dbus service before ver…

Incorrect caching of authentication between different users of the  qSnapper dbus service before version 1.3.3 allowed any local attacker to use dbus functions after a privileged users has authenticated for them.

nvdaltovulnerabilidad CVSS 7.1 NVD

I Crítico vulnerabilidad

22/06/2026

[CVE-2026-12628] IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.…

IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate aut…

nvdcriticovulnerabilidad CVSS 9.1 NVD

P Alto vulnerabilidad

22/06/2026

[CVE-2026-41045] A time-to-check-time-of-use in polkit authentication of qSnapper before version 1.3.3 allowed a loca…

A time-to-check-time-of-use in polkit authentication of qSnapper before version 1.3.3 allowed a local attacker to bypass qSnappers authentication mechanism and operate e.g. as root user.

nvdaltovulnerabilidad CVSS 8.1 NVD

I Alto vulnerabilidad

22/06/2026

[CVE-2026-10845] IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication …

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications.

nvdaltovulnerabilidad CVSS 7.3 NVD

G Alto vulnerabilidad

22/06/2026

[CVE-2026-9029] A user with Editor permissions can place a malicious script in the attribution field of a Geomap pan…

A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).

nvdaltovulnerabilidad CVSS 7.3 NVD

X Crítico vulnerabilidad

22/06/2026

[CVE-2026-6653] Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allow…

Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-56424] MISP core contained multiple broken access-control flaws where authorization checks were performed a…

MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownership/editability checks were missing on write paths. In affected subsystems, a lower-privileged authenticated user with the relevant feature permission could cause the application to authorize one object but mutate another, or could modify objects that were mer…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-56425] The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its …

The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to bypass important security guarantees provided by the protocol. The application used the PHP session identifier (session_id()) as the OAuth state parameter. Because session identifiers are long-lived authentication credentials, exposing the…

nvdaltovulnerabilidad CVSS 8.8 NVD