Threats affecting pkg:generic/radare2

CVE-2026-17404 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality significantly but has limited impact on integrity and no impact on availability.

CVE-2026-17403 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves the use of hard-coded credentials, which could allow a remote attacker to gain full administrative control of the affected system.

CVE-2026-17402 is a critical OS command injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary commands on the underlying host due to improper neutralization of user-supplied input before passing it to the operating system.

CVE-2026-17401 is a stack-based buffer overflow vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary code on the affected system. The vulnerability has a high severity with a CVSS score of 7.2, indicating significant impact on confidentiality, integrity, and availability.

CVE-2026-17400 is a high-severity SQL injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information from the system. The vulnerability does not affect system availability or integrity but compromises confidentiality.

CVE-2026-17399 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves insufficient validation of uploaded file content, allowing a remote authenticated attacker to execute arbitrary code on the server. The flaw arises from unrestricted upload of files with dangerous types that are not properly checked before processing.

CVE-2026-17398 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality significantly but has limited impact on integrity and no impact on availability.

CVE-2026-17397 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to perform server-side request forgery (SSRF), potentially leading to unauthorized access to sensitive information. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality significantly but has limited impact on integrity and no impact on availability.

CVE-2026-17396 is a critical SQL injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information by exploiting improper input handling in SQL queries.

CVE-2026-17395 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make unauthorized requests to internal network resources due to insufficient validation of user-supplied URLs. This improper restriction of destinations can expose internal systems to unauthorized access.

CVE-2026-17394 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to modify object attributes that should be system-controlled, potentially exposing sensitive information. The flaw involves improper control over dynamically-determined object attributes, enabling unauthorized changes to access-related settings.

CVE-2026-17392 is a critical LDAP injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to manipulate LDAP directory queries by injecting malicious input, potentially gaining unauthorized administrative access to other tenants. This vulnerability arises because user input is not properly sanitized before being used in directory queries, enabling privilege escalation across tenant boundaries.

CVE-2026-17391 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls via a user-controlled key, potentially exposing sensitive information. The flaw does not impact integrity or availability but can lead to confidentiality breaches.

CVE-2026-17390 is a cross-site scripting (XSS) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows an authenticated user to execute arbitrary JavaScript code within the web user interface. This can alter page functionality and potentially lead to credential disclosure within a trusted session. The vulnerability has a medium severity rating with a CVSS score of 6.4.

CVE-2026-17389 is an LDAP injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw allows remote attackers to manipulate LDAP directory queries by injecting malicious input that is not properly neutralized. This can lead to unauthorized disclosure of sensitive information from the connected LDAP directory. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-17388 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls by exploiting a broken authorization mechanism involving user-controlled keys, potentially leading to unauthorized access to sensitive information.

CVE-2026-17387 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls by exploiting broken authorization mechanisms, potentially leading to unauthorized access to sensitive information. The vulnerability does not impact integrity or availability but has a significant confidentiality impact.

CVE-2026-17385 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to perform server-side request forgery (SSRF), potentially leading to unauthorized access to sensitive information. The vulnerability does not allow denial of service or full integrity compromise but can expose confidential data.

CVE-2026-17383 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls using a user-controlled key, potentially exposing sensitive information from other tenants. The flaw is due to broken authorization mechanisms at the object level.

CVE-2026-17382 is a path traversal vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw allows a remote authenticated attacker to access sensitive information by exploiting improper validation of file paths.