Threats affecting pkg:generic/radare2

IBM API Connect versions 10.0.8.0 through 10.0.8.12 contain a vulnerability due to the use of a cryptographically weak pseudo-random number generator (PRNG). This weakness could allow a remote attacker to gain full administrative control of the affected system. The vulnerability is identified as CWE-338 and has a high severity rating with a CVSS score of 8.1.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 contain a server-side request forgery (SSRF) vulnerability that allows a remote authenticated attacker to obtain sensitive information. The vulnerability is identified as CWE-918 and has a high severity score of 8.5. It requires low attack complexity and no user interaction but does require privileges to authenticate. The flaw impacts confidentiality significantly but has limited impact on integrity and no impact on availability.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability. This flaw allows a remote attacker to bypass protections that block requests to internal addresses, enabling the server to access internal network resources and potentially disclose sensitive information.

CVE-2026-19131 is a missing authorization vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows low-privileged users to query arbitrary indices and access sensitive data without proper authorization controls.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where the backup server's identity is not properly verified during secure connection establishment for analytics backups. This improper certificate validation could allow a network-positioned attacker to intercept backup data and potentially credentials if used.

CVE-2026-19128 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. An authenticated attacker could exploit this flaw to send unauthorized requests from the system, potentially enumerating internal network resources or facilitating further attacks. The vulnerability has a high severity rating with a CVSS score of 7.5.

CVE-2026-19126 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves the use of password hashing algorithms with insufficient computational effort, which weakens cryptographic protections. This weakness could allow an attacker to decrypt highly sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.9. No public exploits or known active exploitation have been reported. No patch or remediation details are provided in the available data.

CVE-2026-19122 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. An authenticated privileged attacker could exploit this flaw to send unauthorized requests from the system. This may allow the attacker to enumerate internal network resources or facilitate further attacks. The vulnerability has a low CVSS score of 3.8, indicating limited impact on confidentiality and integrity, with no impact on availability. No public exploits or known active exploitation have been reported. No patch information is provided in the available data.

CVE-2026-19121 is an authentication bypass vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. The flaw arises from insufficient verification of tenant context against the authenticated user, potentially allowing an attacker with valid credentials to access resources belonging to other tenants. This vulnerability has a high severity rating with a CVSS score of 8.3.

CVE-2026-18838 is a critical authentication bypass vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. The flaw arises from insufficient verification of identity information supplied in requests, allowing a remote attacker to impersonate other users. This can lead to unauthorized access to sensitive information and modification of API configurations.

CVE-2026-18836 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote attacker to make the affected component send requests to unintended destinations and receive the responses, potentially exposing sensitive information. The vulnerability has a high CVSS score of 9.3, indicating significant impact on confidentiality and integrity without requiring privileges or user interaction.

CVE-2026-18689 is an incorrect authorization vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows an authenticated user to obtain limited information about other organizations by using a token issued for a limited purpose in an unauthorized way. This could reveal the names of other organizations within the system.

CVE-2026-17428 is an authorization bypass vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw arises because values supplied in the request URL are used in authorization decisions without sufficient verification. This could allow a remote authenticated attacker to access sensitive information belonging to other users.

CVE-2026-17411 is a high-severity SQL injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. An authenticated attacker could exploit this flaw to view, add, modify, or delete information in the back-end database because input is not properly sanitized before being used in database queries.

CVE-2026-17410 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves improper neutralization of argument delimiters (CWE-88), allowing a remote authenticated attacker to access and modify portal data belonging to other tenants. This flaw impacts confidentiality, integrity, and availability of affected systems.

CVE-2026-17409 affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The vulnerability arises from improper handling of case sensitivity in access controls, allowing a remote attacker to bypass restrictions and execute unauthorized administrative operations or access sensitive information.

CVE-2026-17408 is a critical OS command injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote attacker to execute arbitrary code due to improper neutralization of special elements in OS commands.

CVE-2026-17407 is a high-severity SQL injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary SQL commands by exploiting improper neutralization of input values during sign-in. This flaw could lead to complete compromise of confidentiality, integrity, and availability of the affected system's data.

CVE-2026-17406 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw where address checks can be bypassed, allowing a remote authenticated attacker to make the server reach destinations that should be blocked and potentially obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an authorization bypass vulnerability. This flaw allows a remote authenticated attacker to access sensitive keystore information without proper permission checks. The issue arises because access controls on keystore objects do not verify if the requesting user is authorized to read them, potentially exposing critical data.