Threat database

CVE-2026-17117 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary code by improperly controlling modification of dynamically-determined object attributes. Specifically, a user can set a field that should be system-controlled, leading to potential code execution.

CVE-2026-17114 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information and cause a denial of service by triggering error messages that expose sensitive data.

CVE-2026-17112 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls and access sensitive information belonging to other tenants. This flaw arises from broken authorization checks related to user-controlled keys.

CVE-2026-17108 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves server-side request forgery (SSRF) that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality heavily but has limited impact on integrity and no impact on availability.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where verbose error messages may disclose sensitive information to remote attackers. This issue is classified under CWE-209, indicating that error messages reveal information that could aid an attacker. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-17085 affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The vulnerability arises from improper handling of case sensitivity in access restrictions, which allows a remote authenticated attacker to bypass security controls and send unauthorized emails. The flaw does not impact confidentiality or availability but can lead to limited integrity violations. The CVSS score is 4.1, indicating medium severity.

CVE-2026-17067 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access internal network resources by exploiting the SSRF flaw. The vulnerability has a medium severity with a CVSS score of 5.5.

CVE-2026-17066 is a critical vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves missing authorization controls that could allow a remote authenticated attacker to access sensitive information and modify or delete data belonging to other tenants. The flaw affects multi-tenant environments and poses a high risk to confidentiality, integrity, and availability of data.

CVE-2026-17064 is a medium severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass authorization controls via an insecure direct object reference, potentially exposing sensitive information. The vulnerability does not impact integrity or availability, and no public exploits are known.

CVE-2026-17062 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves improper neutralization of argument delimiters, allowing a remote authenticated attacker to inject additional parameters into internal server requests by exploiting unsafe handling of special characters in user input. The vulnerability has a low severity rating with a CVSS score of 2.7.

CVE-2026-17049 is a critical vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass authorization controls by exploiting user-controlled keys, potentially leading to unauthorized access to sensitive information and modification of arbitrary documents.

CVE-2026-16920 is a critical confused deputy vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass security restrictions, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-16918 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw allows a remote attacker to make the server access internal network resources, potentially leading to unauthorized information disclosure. The vulnerability has a high CVSS score of 9.3, indicating severe impact on confidentiality with limited impact on integrity and no impact on availability.

CVE-2026-16912 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not require user interaction and impacts confidentiality with limited integrity impact and no availability impact.

CVE-2026-16884 is a critical vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves improper restriction of XML external entity references (XXE), which could allow a remote attacker to obtain sensitive information. The vulnerability has a high CVSS score of 9.9, indicating severe impact including confidentiality and availability. No public exploits or vendor patches are currently documented in the provided data.

CVE-2026-16880 is a path traversal vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access sensitive information by exploiting improper validation of file paths. The vulnerability has a high severity with a CVSS score of 8.5.

CVE-2026-16854 is a SQL Injection vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to exploit improper input neutralization in data queries, potentially exposing sensitive information from other tenants. The vulnerability does not impact data integrity or availability but can lead to unauthorized data disclosure.

CVE-2026-16720 is a critical improper authentication vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw allows a remote attacker to obtain valid access tokens for other users by exploiting insufficient enforcement of authentication against a connected directory service. This could enable the attacker to assume another user's identity with full access rights.

CVE-2026-16719 is a path traversal vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw allows a remote attacker with limited privileges to craft a URL request that accesses files outside the intended directory, potentially exposing sensitive information. The vulnerability has a medium severity with a CVSS score of 6.5 and impacts confidentiality without affecting integrity or availability.

CVE-2026-16718 is a path traversal vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access sensitive information by exploiting improper validation of file paths.