Threats affecting pkg:generic/radare2

CVE-2026-17333 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves improper certificate validation that could allow a remote attacker to bypass authentication and inject unauthorized configuration changes.

CVE-2026-17332 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves improper certificate validation that could allow a remote attacker to bypass security restrictions. This flaw affects the confidentiality and integrity of the system but does not impact availability. No public exploits or known active exploitation have been reported. No patch or remediation details are provided in the available data.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows remote attackers to read arbitrary files on the server by externally controlling the file name or path. This flaw is identified as CWE-73 and has a high severity rating with a CVSS score of 7.5.

CVE-2026-17330 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality significantly but has limited impact on integrity and no impact on availability.

CVE-2026-17329 is a critical Server-Side Request Forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote attacker to obtain sensitive information by exploiting improper validation of endpoint URLs.

CVE-2026-17328 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) issue caused by incomplete input validation, which could allow a remote authenticated attacker to bypass input checks and obtain sensitive information.

CVE-2026-17327 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality significantly but has limited impact on integrity and no impact on availability.

CVE-2026-17326 is an improper authentication vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass security restrictions, potentially leading to unauthorized access with high confidentiality and integrity impact but no availability impact.

CVE-2026-17325 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw where improper validation of user-supplied URLs allows a remote authenticated attacker to obtain sensitive information. The vulnerability has a CVSS 3.1 base score of 8.5, indicating significant confidentiality impact with limited integrity impact and no availability impact.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability due to missing authentication for a critical function. This flaw could allow a remote attacker to access sensitive configuration data and perform unauthorized actions without any authentication.

CVE-2026-17323 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves improper restriction of XML external entity references (XXE), which could allow a remote attacker to obtain sensitive information. The vulnerability does not require user interaction or privileges and has a low attack complexity. No known exploits are reported in the wild.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where sensitive information is inserted into log files. This flaw could allow a local attacker with limited privileges to access sensitive credentials from these logs and potentially compromise accounts.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization bypass vulnerability (CWE-639) that allows a remote authenticated attacker to delete or overwrite arbitrary control-plane assets. This occurs due to an insecure direct object reference flaw, enabling unauthorized modification of critical assets.

CVE-2026-17320 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves an authorization bypass due to an insecure direct object reference, allowing a remote authenticated attacker to access sensitive information without proper authorization.

CVE-2026-17319 is a vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2 where improper authorization allows a remote authenticated attacker to modify tool configuration. The flaw arises because the system relies on client-supplied information to determine user permissions, enabling unauthorized changes that can disrupt service and cause denial of service.

CVE-2026-17318 is an authorization bypass vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. A remote authenticated attacker could exploit this flaw to obtain sensitive information due to improper authorization controls.

CVE-2026-17317 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access internal resources and cause a denial of service. The vulnerability has a medium severity rating with a CVSS score of 6.4.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability due to improper validation of user-supplied input. This flaw could allow a remote attacker to induce the server to make unintended requests. The vulnerability has a high severity rating with a CVSS score of 7.2.

CVE-2026-17315 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. This flaw allows a remote attacker to obtain sensitive information by exploiting improper validation of user-supplied URLs.

CVE-2026-17314 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make unintended requests, potentially leading to the exposure of sensitive information. The vulnerability has a medium severity with a CVSS score of 5. No public exploits or active exploitation in the wild have been reported. IBM has not provided specific patch information in the available data.