Threats affecting pkg:generic/opencv

CVE-2026-17389 is an LDAP injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw allows remote attackers to manipulate LDAP directory queries by injecting malicious input that is not properly neutralized. This can lead to unauthorized disclosure of sensitive information from the connected LDAP directory. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-17388 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls by exploiting a broken authorization mechanism involving user-controlled keys, potentially leading to unauthorized access to sensitive information.

CVE-2026-17387 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls by exploiting broken authorization mechanisms, potentially leading to unauthorized access to sensitive information. The vulnerability does not impact integrity or availability but has a significant confidentiality impact.

CVE-2026-17385 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to perform server-side request forgery (SSRF), potentially leading to unauthorized access to sensitive information. The vulnerability does not allow denial of service or full integrity compromise but can expose confidential data.

CVE-2026-17383 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls using a user-controlled key, potentially exposing sensitive information from other tenants. The flaw is due to broken authorization mechanisms at the object level.

CVE-2026-17382 is a path traversal vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw allows a remote authenticated attacker to access sensitive information by exploiting improper validation of file paths.

CVE-2026-17381 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass authorization controls by exploiting improper validation of user-controlled keys, potentially leading to disclosure of sensitive information.

CVE-2026-17380 is a path traversal vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access sensitive information belonging to other tenants by exploiting insufficient validation of a path parameter in requests. This vulnerability can lead to unauthorized data disclosure across tenant boundaries.

CVE-2026-17379 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves improper verification of cryptographic signatures, which could allow a remote attacker to bypass authentication and assign arbitrary roles.

CVE-2026-17378 is an incorrect authorization vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access sensitive information due to broken object-level authorization controls.

CVE-2026-17377 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to forge audit records due to improper output neutralization for logs, classified under CWE-117. The vulnerability has a medium severity with a CVSS score of 5.0.

CVE-2026-17376 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls and obtain sensitive information. The flaw is due to broken object-level authorization related to user-controlled keys.

CVE-2026-17375 is a high-severity authorization bypass vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw arises because authorization decisions rely on client-supplied information, which can be manipulated by a remote authenticated attacker to access sensitive information they should not be able to see. This vulnerability does not affect availability or integrity but compromises confidentiality.

CVE-2026-17374 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls by exploiting a flaw related to user-controlled keys, potentially leading to unauthorized access to sensitive information. The vulnerability does not impact system integrity or availability but compromises confidentiality.

CVE-2026-17373 is an incorrect authorization vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access sensitive information without proper authorization.

CVE-2026-17372 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make unauthorized requests to internal network resources by exploiting insufficient validation of user-configured webhook destination URLs.

CVE-2026-17371 is a medium severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls, potentially leading to unauthorized access to sensitive information. The flaw is due to broken object-level authorization related to user-controlled keys.

CVE-2026-17370 is an improper authentication vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain an access token for another user by exploiting insufficient verification in the sign-in flow, potentially enabling identity assumption.

A Cross-Site Request Forgery (CSRF) vulnerability exists in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw allows a remote attacker to trick a user into authenticating into an attacker-controlled account because the sign-in process does not properly verify that the login response matches the user's original request. This could result in the victim's session being linked to the attacker's account.

CVE-2026-17368 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to make the server send requests to unintended destinations, potentially performing network reconnaissance and obtaining sensitive credentials. The vulnerability has a CVSS 3.1 base score of 6.8, indicating medium severity.