Threats affecting pkg:generic/radare2

CVE-2026-17381 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass authorization controls by exploiting improper validation of user-controlled keys, potentially leading to disclosure of sensitive information.

CVE-2026-17380 is a path traversal vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access sensitive information belonging to other tenants by exploiting insufficient validation of a path parameter in requests. This vulnerability can lead to unauthorized data disclosure across tenant boundaries.

CVE-2026-17379 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves improper verification of cryptographic signatures, which could allow a remote attacker to bypass authentication and assign arbitrary roles.

CVE-2026-17378 is an incorrect authorization vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access sensitive information due to broken object-level authorization controls.

CVE-2026-17377 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to forge audit records due to improper output neutralization for logs, classified under CWE-117. The vulnerability has a medium severity with a CVSS score of 5.0.

CVE-2026-17376 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls and obtain sensitive information. The flaw is due to broken object-level authorization related to user-controlled keys.

CVE-2026-17375 is a high-severity authorization bypass vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw arises because authorization decisions rely on client-supplied information, which can be manipulated by a remote authenticated attacker to access sensitive information they should not be able to see. This vulnerability does not affect availability or integrity but compromises confidentiality.

CVE-2026-17374 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls by exploiting a flaw related to user-controlled keys, potentially leading to unauthorized access to sensitive information. The vulnerability does not impact system integrity or availability but compromises confidentiality.

CVE-2026-17373 is an incorrect authorization vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access sensitive information without proper authorization.

CVE-2026-17372 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make unauthorized requests to internal network resources by exploiting insufficient validation of user-configured webhook destination URLs.

CVE-2026-17371 is a medium severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls, potentially leading to unauthorized access to sensitive information. The flaw is due to broken object-level authorization related to user-controlled keys.

CVE-2026-17370 is an improper authentication vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain an access token for another user by exploiting insufficient verification in the sign-in flow, potentially enabling identity assumption.

A Cross-Site Request Forgery (CSRF) vulnerability exists in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw allows a remote attacker to trick a user into authenticating into an attacker-controlled account because the sign-in process does not properly verify that the login response matches the user's original request. This could result in the victim's session being linked to the attacker's account.

CVE-2026-17368 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to make the server send requests to unintended destinations, potentially performing network reconnaissance and obtaining sensitive credentials. The vulnerability has a CVSS 3.1 base score of 6.8, indicating medium severity.

CVE-2026-17367 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials. The vulnerability has a medium severity with a CVSS score of 5.4.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to bypass object-level authorization controls. This flaw could enable the attacker to access sensitive information without proper authorization. The vulnerability is classified under CWE-639, indicating an authorization bypass through user-controlled keys. The CVSS v3.1 base score is 5.0, reflecting a medium severity level.

CVE-2026-17365 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality significantly but has limited impact on integrity and no impact on availability.

CVE-2026-17363 is a high severity SQL injection vulnerability affecting IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information by exploiting improper input handling in SQL queries.

CVE-2026-17361 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. This flaw allows a remote authenticated attacker to cause the server to make unintended requests, potentially leading to the exposure of sensitive information. The vulnerability has a high severity rating with a CVSS score of 7.7.

CVE-2026-17360 is a critical vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves the use of hard-coded credentials that could allow a remote attacker to gain full administrative control of the affected system.