Export limit exceeded: 420944 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420944 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420944 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420944 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420944 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-17384 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.5 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability. | ||||
| CVE-2026-75590 | 1 Ibm | 1 Api Connect | 2026-11-07 | 7.2 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources and obtain sensitive information due to server-side request forgery. A protection that blocks requests to internal addresses can be bypassed, so the server could be made to contact internal services and return part of their responses. | ||||
| CVE-2026-19131 | 1 Ibm | 1 Api Connect | 2026-11-07 | 6.5 Medium |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow low-privileged users to query arbitrary indices and read sensitive data due to missing authorization. | ||||
| CVE-2026-19129 | 1 Ibm | 1 Api Connect | 2026-11-07 | 6.8 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a network-positioned attacker to intercept backup data due to improper verification of the backup server's identity. The identity of the backup server is not verified when the secure connection for analytics backups is established, which could allow backup data, and credentials if used, to be intercepted. | ||||
| CVE-2026-19128 | 1 Ibm | 1 Api Connect | 2026-11-07 | 7.5 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks. | ||||
| CVE-2026-19126 | 1 Ibm | 1 Api Connect | 2026-11-07 | 5.9 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. | ||||
| CVE-2026-19122 | 1 Ibm | 1 Api Connect | 2026-11-07 | 3.8 Low |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated privileged attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks. | ||||
| CVE-2026-19121 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.3 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources. | ||||
| CVE-2026-18838 | 1 Ibm | 1 Api Connect | 2026-11-07 | 9.4 Critical |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which could allow a caller to impersonate another user. | ||||
| CVE-2026-18836 | 1 Ibm | 1 Api Connect | 2026-11-07 | 9.3 Critical |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker. | ||||
| CVE-2026-18689 | 1 Ibm | 1 Api Connect | 2026-11-07 | 4.3 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations. | ||||
| CVE-2026-17428 | 1 Ibm | 1 Api Connect | 2026-11-07 | 5 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others. | ||||
| CVE-2026-17411 | 1 Ibm | 1 Api Connect | 2026-11-07 | 7.6 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries. | ||||
| CVE-2026-17410 | 1 Ibm | 1 Api Connect | 2026-11-07 | 9.9 Critical |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters. | ||||
| CVE-2026-17409 | 1 Ibm | 1 Api Connect | 2026-11-07 | 9.4 Critical |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached. | ||||
| CVE-2026-17408 | 1 Ibm | 1 Api Connect | 2026-11-07 | 9.8 Critical |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command. | ||||
| CVE-2026-17407 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.5 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run. | ||||
| CVE-2026-17406 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.5 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked. | ||||
| CVE-2026-17405 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.8 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information. | ||||
| CVE-2026-17404 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.5 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. | ||||