Threats affecting pkg:generic/opencv

CVE-2026-17410 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves improper neutralization of argument delimiters (CWE-88), allowing a remote authenticated attacker to access and modify portal data belonging to other tenants. This flaw impacts confidentiality, integrity, and availability of affected systems.

CVE-2026-17409 affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The vulnerability arises from improper handling of case sensitivity in access controls, allowing a remote attacker to bypass restrictions and execute unauthorized administrative operations or access sensitive information.

CVE-2026-17408 is a critical OS command injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote attacker to execute arbitrary code due to improper neutralization of special elements in OS commands.

CVE-2026-17407 is a high-severity SQL injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary SQL commands by exploiting improper neutralization of input values during sign-in. This flaw could lead to complete compromise of confidentiality, integrity, and availability of the affected system's data.

CVE-2026-17406 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw where address checks can be bypassed, allowing a remote authenticated attacker to make the server reach destinations that should be blocked and potentially obtain sensitive information.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an authorization bypass vulnerability. This flaw allows a remote authenticated attacker to access sensitive keystore information without proper permission checks. The issue arises because access controls on keystore objects do not verify if the requesting user is authorized to read them, potentially exposing critical data.

CVE-2026-17404 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality significantly but has limited impact on integrity and no impact on availability.

CVE-2026-17403 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves the use of hard-coded credentials, which could allow a remote attacker to gain full administrative control of the affected system.

CVE-2026-17402 is a critical OS command injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary commands on the underlying host due to improper neutralization of user-supplied input before passing it to the operating system.

CVE-2026-17401 is a stack-based buffer overflow vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary code on the affected system. The vulnerability has a high severity with a CVSS score of 7.2, indicating significant impact on confidentiality, integrity, and availability.

CVE-2026-17400 is a high-severity SQL injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information from the system. The vulnerability does not affect system availability or integrity but compromises confidentiality.

CVE-2026-17399 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves insufficient validation of uploaded file content, allowing a remote authenticated attacker to execute arbitrary code on the server. The flaw arises from unrestricted upload of files with dangerous types that are not properly checked before processing.

CVE-2026-17398 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality significantly but has limited impact on integrity and no impact on availability.

CVE-2026-17397 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to perform server-side request forgery (SSRF), potentially leading to unauthorized access to sensitive information. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality significantly but has limited impact on integrity and no impact on availability.

CVE-2026-17396 is a critical SQL injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information by exploiting improper input handling in SQL queries.

CVE-2026-17395 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make unauthorized requests to internal network resources due to insufficient validation of user-supplied URLs. This improper restriction of destinations can expose internal systems to unauthorized access.

CVE-2026-17394 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to modify object attributes that should be system-controlled, potentially exposing sensitive information. The flaw involves improper control over dynamically-determined object attributes, enabling unauthorized changes to access-related settings.

CVE-2026-17392 is a critical LDAP injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to manipulate LDAP directory queries by injecting malicious input, potentially gaining unauthorized administrative access to other tenants. This vulnerability arises because user input is not properly sanitized before being used in directory queries, enabling privilege escalation across tenant boundaries.

CVE-2026-17391 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls via a user-controlled key, potentially exposing sensitive information. The flaw does not impact integrity or availability but can lead to confidentiality breaches.

CVE-2026-17390 is a cross-site scripting (XSS) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows an authenticated user to execute arbitrary JavaScript code within the web user interface. This can alter page functionality and potentially lead to credential disclosure within a trusted session. The vulnerability has a medium severity rating with a CVSS score of 6.4.