Threat database

CVE-2026-16920 is a critical confused deputy vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass security restrictions, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-16918 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw allows a remote attacker to make the server access internal network resources, potentially leading to unauthorized information disclosure. The vulnerability has a high CVSS score of 9.3, indicating severe impact on confidentiality with limited impact on integrity and no impact on availability.

CVE-2026-16912 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not require user interaction and impacts confidentiality with limited integrity impact and no availability impact.

CVE-2026-16884 is a critical vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves improper restriction of XML external entity references (XXE), which could allow a remote attacker to obtain sensitive information. The vulnerability has a high CVSS score of 9.9, indicating severe impact including confidentiality and availability. No public exploits or vendor patches are currently documented in the provided data.

CVE-2026-16880 is a path traversal vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access sensitive information by exploiting improper validation of file paths. The vulnerability has a high severity with a CVSS score of 8.5.

CVE-2026-16854 is a SQL Injection vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to exploit improper input neutralization in data queries, potentially exposing sensitive information from other tenants. The vulnerability does not impact data integrity or availability but can lead to unauthorized data disclosure.

CVE-2026-16720 is a critical improper authentication vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw allows a remote attacker to obtain valid access tokens for other users by exploiting insufficient enforcement of authentication against a connected directory service. This could enable the attacker to assume another user's identity with full access rights.

CVE-2026-16719 is a path traversal vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw allows a remote attacker with limited privileges to craft a URL request that accesses files outside the intended directory, potentially exposing sensitive information. The vulnerability has a medium severity with a CVSS score of 6.5 and impacts confidentiality without affecting integrity or availability.

CVE-2026-16718 is a path traversal vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access sensitive information by exploiting improper validation of file paths.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization bypass vulnerability (CWE-639) that allows a remote authenticated attacker to access sensitive information. This flaw arises from broken object-level authorization due to user-controlled keys. The vulnerability has a high severity with a CVSS score of 7.7.

CVE-2026-16716 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass security restrictions and access or modify sensitive information due to improper restriction of security token assignment.

CVE-2026-16715 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls and access sensitive information belonging to other tenants. This flaw arises from broken object-level authorization related to user-controlled keys.

A path traversal vulnerability (CWE-22) exists in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw could allow a remote attacker to overwrite arbitrary files on the affected system.

CVE-2026-16712 is a high-severity authorization bypass vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access sensitive information belonging to other tenants due to insufficient permission checks on identifiers supplied in requests.

CVE-2026-16711 is an authorization vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw involves insufficient input validation that may allow a remote attacker to inject platform credentials into outbound requests. This improper authorization could lead to unintended credential exposure. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-16710 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make unauthorized requests, potentially leading to the exposure of sensitive information. The vulnerability has a medium severity with a CVSS score of 5.8.

CVE-2026-16709 is a cross-site scripting (XSS) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary JavaScript in another user's browser session by injecting script content through improperly neutralized user input when a web page is updated.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 and 10.0.8.0 through 10.0.8.12 contain a path traversal vulnerability. This flaw allows a remote attacker with limited privileges to craft a URL request that can access files outside the intended directories on the system. The vulnerability could lead to unauthorized disclosure of arbitrary files.

CVE-2026-108178 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves an improperly implemented security check that can cause token validation to be incomplete, allowing a token to be accepted for unintended purposes.

CVE-2026-105459 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves improper verification of cryptographic signatures, where a token can be accepted without full signature validation. This flaw could allow an attacker to gain unauthorized access to an organization by joining it without a valid invitation.