Threats affecting pkg:generic/radare2

CVE-2026-17359 is a critical code injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary code by influencing the code generation process through user-supplied input. This vulnerability has a high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-17358 is an improper authentication vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass tenant isolation by exploiting insufficiently isolated authentication checks, potentially enabling cross-tenant access.

CVE-2026-17357 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access internal network services. The vulnerability has a high severity with a CVSS score of 7.6.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability involving the use of a hard-coded cryptographic key. This flaw could allow a local attacker to obtain sensitive information. The vulnerability is classified as CWE-321 and has a high severity rating with a CVSS score of 8.7.

CVE-2026-17355 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. This flaw allows a remote authenticated attacker to bypass destination checks on outbound requests, potentially accessing sensitive information from internal network resources that should be blocked.

CVE-2026-17354 is a critical path traversal vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to perform arbitrary file writes, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-17353 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass security restrictions and obtain sensitive information. The vulnerability has a high CVSS score of 9.6, indicating severe confidentiality and integrity impacts without availability impact.

CVE-2026-17352 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information. The vulnerability has a high severity with a CVSS score of 8.5, indicating significant confidentiality impact but limited integrity and no availability impact.

CVE-2026-17345 is a high-severity SQL Injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information by exploiting improper neutralization of special elements in SQL commands. The vulnerability does not impact integrity or availability but can lead to significant confidentiality breaches.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that allows a remote attacker to cause the service to send requests to unintended destinations. This vulnerability can be exploited without authentication and may lead to the exposure of sensitive information.

CVE-2026-17343 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass authorization checks and access or modify sensitive information due to improper authorization implementation.

CVE-2026-17342 is a critical code injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary code due to improper control over code generation.

CVE-2026-17341 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote attacker to perform server-side request forgery (SSRF) and relay unauthorized email messages by exploiting improper neutralization of user-supplied input.

A critical path traversal vulnerability (CWE-22) exists in IBM API Connect versions 12.1.0.0 through 12.1.1.2. This flaw could allow a remote attacker to execute arbitrary code on the affected system without any privileges or user interaction. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-17339 is a critical path traversal vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access or delete resources belonging to other tenants. This vulnerability arises from improper validation of file paths, enabling unauthorized cross-tenant resource manipulation.

CVE-2026-17338 is a critical vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves broken object-level authorization that could allow a remote authenticated attacker to access sensitive information. The flaw is due to authorization bypass through a user-controlled key.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a race condition vulnerability that can allow a remote authenticated attacker to bypass authentication. This occurs due to improper and unreliable certificate validation, potentially permitting connections without proper authentication.

CVE-2026-17336 is a critical SQL Injection vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements in SQL queries. The vulnerability has a CVSS 3.1 score of 9.9, indicating high impact on confidentiality, integrity, and availability.

CVE-2026-17335 is a path traversal vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to write files outside the intended directory by exploiting insufficient validation of file paths in uploaded content, potentially leading to arbitrary code execution.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization bypass vulnerability due to improper authorization checks involving user-controlled keys. This flaw allows a remote authenticated attacker to access sensitive information without proper permissions.