CWE-918: Server-Side Request Forgery vulnerabilities

CVE-2026-17341 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote attacker to perform server-side request forgery (SSRF) and relay unauthorized email messages by exploiting improper neutralization of user-supplied input.

CVE-2026-17330 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality significantly but has limited impact on integrity and no impact on availability.

CVE-2026-17329 is a critical Server-Side Request Forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote attacker to obtain sensitive information by exploiting improper validation of endpoint URLs.

CVE-2026-17328 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) issue caused by incomplete input validation, which could allow a remote authenticated attacker to bypass input checks and obtain sensitive information.

CVE-2026-17327 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality significantly but has limited impact on integrity and no impact on availability.

CVE-2026-17325 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw where improper validation of user-supplied URLs allows a remote authenticated attacker to obtain sensitive information. The vulnerability has a CVSS 3.1 base score of 8.5, indicating significant confidentiality impact with limited integrity impact and no availability impact.

CVE-2026-17317 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access internal resources and cause a denial of service. The vulnerability has a medium severity rating with a CVSS score of 6.4.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability due to improper validation of user-supplied input. This flaw could allow a remote attacker to induce the server to make unintended requests. The vulnerability has a high severity rating with a CVSS score of 7.2.

CVE-2026-17315 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. This flaw allows a remote attacker to obtain sensitive information by exploiting improper validation of user-supplied URLs.

CVE-2026-17314 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make unintended requests, potentially leading to the exposure of sensitive information. The vulnerability has a medium severity with a CVSS score of 5. No public exploits or active exploitation in the wild have been reported. IBM has not provided specific patch information in the available data.

CVE-2026-17306 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. This flaw could allow a remote attacker to cause the server to make unauthorized requests to internal network resources, potentially exposing sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.8.

CVE-2026-17305 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make unauthorized requests, potentially leading to the exposure of sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.5.

CVE-2026-17304 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to retrieve unauthorized content due to insufficient validation of locations supplied during service definition imports.

CVE-2026-17303 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make requests to internal network resources by supplying a crafted URL that is not properly validated. This improper validation can lead to unauthorized access to internal systems.

CVE-2026-17302 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to send crafted requests that could probe internal network services due to improper validation of user-supplied URLs. The vulnerability has a medium severity with a CVSS score of 5. No public exploits or known active exploitation have been reported. No patch information is provided in the available data.

CVE-2026-17299 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to perform arbitrary file reads and SSRF by exploiting insufficient restrictions on externally referenced content in submitted definitions. The vulnerability arises from unrestricted resolution of external references, which can lead to sensitive content being retrieved and returned to the attacker.

CVE-2026-17298 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make unauthorized requests, potentially leading to the exposure of sensitive information. The vulnerability has a CVSS score of 9.9, indicating a high impact on confidentiality, integrity, and availability.

CVE-2026-17296 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw allows a remote authenticated attacker to cause the server to make unauthorized requests, potentially leading to the exposure of sensitive information. The vulnerability has a high CVSS score of 9.6, indicating severe confidentiality and integrity impacts without affecting availability.

CVE-2026-17294 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. A remote authenticated attacker could exploit this flaw to obtain sensitive information from the system. The vulnerability has a high severity with a CVSS score of 8.5.

CVE-2026-17289 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information by exploiting SSRF. The vulnerability has a high severity with a CVSS score of 7.7.