Threat database

CVE-2026-17368 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to make the server send requests to unintended destinations, potentially performing network reconnaissance and obtaining sensitive credentials. The vulnerability has a CVSS 3.1 base score of 6.8, indicating medium severity.

CVE-2026-17367 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials. The vulnerability has a medium severity with a CVSS score of 5.4.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to bypass object-level authorization controls. This flaw could enable the attacker to access sensitive information without proper authorization. The vulnerability is classified under CWE-639, indicating an authorization bypass through user-controlled keys. The CVSS v3.1 base score is 5.0, reflecting a medium severity level.

CVE-2026-17365 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality significantly but has limited impact on integrity and no impact on availability.

CVE-2026-17363 is a high severity SQL injection vulnerability affecting IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information by exploiting improper input handling in SQL queries.

CVE-2026-17361 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. This flaw allows a remote authenticated attacker to cause the server to make unintended requests, potentially leading to the exposure of sensitive information. The vulnerability has a high severity rating with a CVSS score of 7.7.

CVE-2026-17360 is a critical vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves the use of hard-coded credentials that could allow a remote attacker to gain full administrative control of the affected system.

CVE-2026-17359 is a critical code injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary code by influencing the code generation process through user-supplied input. This vulnerability has a high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-17358 is an improper authentication vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass tenant isolation by exploiting insufficiently isolated authentication checks, potentially enabling cross-tenant access.

CVE-2026-17357 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access internal network services. The vulnerability has a high severity with a CVSS score of 7.6.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability involving the use of a hard-coded cryptographic key. This flaw could allow a local attacker to obtain sensitive information. The vulnerability is classified as CWE-321 and has a high severity rating with a CVSS score of 8.7.

CVE-2026-17355 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. This flaw allows a remote authenticated attacker to bypass destination checks on outbound requests, potentially accessing sensitive information from internal network resources that should be blocked.

CVE-2026-17354 is a critical path traversal vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to perform arbitrary file writes, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-17353 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass security restrictions and obtain sensitive information. The vulnerability has a high CVSS score of 9.6, indicating severe confidentiality and integrity impacts without availability impact.

CVE-2026-17352 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information. The vulnerability has a high severity with a CVSS score of 8.5, indicating significant confidentiality impact but limited integrity and no availability impact.

CVE-2026-17345 is a high-severity SQL Injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information by exploiting improper neutralization of special elements in SQL commands. The vulnerability does not impact integrity or availability but can lead to significant confidentiality breaches.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that allows a remote attacker to cause the service to send requests to unintended destinations. This vulnerability can be exploited without authentication and may lead to the exposure of sensitive information.

CVE-2026-17343 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass authorization checks and access or modify sensitive information due to improper authorization implementation.

CVE-2026-17342 is a critical code injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary code due to improper control over code generation.

CVE-2026-17341 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote attacker to perform server-side request forgery (SSRF) and relay unauthorized email messages by exploiting improper neutralization of user-supplied input.