Threat database

CVE-2026-17301 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves improper verification of a cryptographic signature, which could allow an unauthenticated attacker to bypass authentication controls.

CVE-2026-17299 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to perform arbitrary file reads and SSRF by exploiting insufficient restrictions on externally referenced content in submitted definitions. The vulnerability arises from unrestricted resolution of external references, which can lead to sensitive content being retrieved and returned to the attacker.

CVE-2026-17298 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make unauthorized requests, potentially leading to the exposure of sensitive information. The vulnerability has a CVSS score of 9.9, indicating a high impact on confidentiality, integrity, and availability.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an open redirect vulnerability. This flaw allows a remote attacker to manipulate the redirect address during sign-in, which is not properly validated. Exploiting this could lead to an account takeover by redirecting authentication results to an attacker-controlled location.

CVE-2026-17296 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw allows a remote authenticated attacker to cause the server to make unauthorized requests, potentially leading to the exposure of sensitive information. The vulnerability has a high CVSS score of 9.6, indicating severe confidentiality and integrity impacts without affecting availability.

CVE-2026-17295 is a path traversal vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access sensitive information by exploiting improper validation of file paths.

CVE-2026-17294 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. A remote authenticated attacker could exploit this flaw to obtain sensitive information from the system. The vulnerability has a high severity with a CVSS score of 8.5.

CVE-2026-17293 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass authorization controls and modify user profile information due to broken object-level authorization. The access control checks fail to verify whether the user has permission to change the targeted profile.

CVE-2026-17292 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass authorization controls and take over ownership of organizations they do not control due to incomplete access checks on organization objects.

CVE-2026-17291 is an open redirect vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to manipulate the redirect address used during OAuth 2.0 sign-in, which is insufficiently validated. This flaw could enable an attacker to redirect authentication results to a malicious location, potentially leading to account takeover.

CVE-2026-17290 is an authentication bypass vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw allows a remote authenticated attacker to create unauthorized user accounts by exploiting improper verification of cryptographic signatures. Specifically, identity information from a login provider is accepted without full signature verification, enabling forged identity data to be used for account creation.

CVE-2026-17289 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information by exploiting SSRF. The vulnerability has a high severity with a CVSS score of 7.7.

CVE-2026-17288 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to perform server-side request forgery (SSRF), potentially leading to unauthorized access to sensitive information.

CVE-2026-17287 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to send requests to unintended destinations by exploiting insufficient validation of user-supplied addresses. This can lead to unauthorized access to sensitive information.

CVE-2026-17285 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw arises from improper validation of external references during schema validation, allowing a remote authenticated attacker to cause the server to retrieve unauthorized content. This vulnerability can lead to the disclosure of sensitive information without impacting integrity or availability.

CVE-2026-17284 is a high-severity authorization bypass vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker with low privileges to perform unauthorized operations in other tenants' environments due to insufficient validation of client-supplied tenant context information. This flaw could enable attackers to act on resources belonging to other tenants, potentially impacting confidentiality and integrity.

CVE-2026-17283 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls and obtain sensitive information. The flaw is due to broken object-level authorization related to user-controlled keys.

CVE-2026-17282 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls via a user-controlled key, potentially exposing sensitive information. The vulnerability does not affect availability or integrity but impacts confidentiality significantly.

CVE-2026-17281 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw allows a remote authenticated attacker to cause the server to make unintended requests, potentially leading to the exposure of sensitive information. The vulnerability has a high severity rating with a CVSS score of 7.7, indicating a significant confidentiality impact without affecting integrity or availability.

CVE-2026-17280 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows remote attackers to perform unauthenticated brute-force attacks due to improper restriction of excessive authentication attempts. This flaw could enable attackers to obtain valid credentials, potentially leading to full system compromise.