Threats affecting pkg:generic/radare2

CVE-2026-17313 is a critical authentication bypass vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote attacker to bypass authentication via an alternate path, potentially obtaining sensitive information and gaining control over gateway configuration.

CVE-2026-17312 is a cross-site request forgery (CSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote attacker to trick a user into authenticating to an attacker-controlled account because the sign-in process does not properly verify that the login response matches the user's original request. This could cause the victim's session to be linked to the attacker's account.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization bypass vulnerability (CWE-639) that allows a remote authenticated attacker to modify application API subscriptions. This occurs due to broken object-level authorization, potentially enabling unauthorized changes to API subscriptions.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability due to the use of a hard-coded cryptographic key. This flaw could allow a remote attacker to obtain sensitive information. The vulnerability is identified as CWE-321 and has a CVSS 3.1 base score of 6.5, indicating a medium severity level.

CVE-2026-17309 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves improper certificate validation that could allow a remote attacker to obtain sensitive information and tamper with configuration settings.

CVE-2026-17308 is a vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2 involving improper certificate validation. This flaw could allow a remote attacker to obtain sensitive credentials and manipulate tool responses. The vulnerability has a CVSS score of 6.8, indicating a medium severity level.

CVE-2026-17307 is a medium severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls and obtain sensitive information. The flaw is due to broken authorization checks related to user-controlled keys. No public exploits or patches are currently documented.

CVE-2026-17306 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. This flaw could allow a remote attacker to cause the server to make unauthorized requests to internal network resources, potentially exposing sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.8.

CVE-2026-17305 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make unauthorized requests, potentially leading to the exposure of sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.5.

CVE-2026-17304 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to retrieve unauthorized content due to insufficient validation of locations supplied during service definition imports.

CVE-2026-17303 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make requests to internal network resources by supplying a crafted URL that is not properly validated. This improper validation can lead to unauthorized access to internal systems.

CVE-2026-17302 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to send crafted requests that could probe internal network services due to improper validation of user-supplied URLs. The vulnerability has a medium severity with a CVSS score of 5. No public exploits or known active exploitation have been reported. No patch information is provided in the available data.

CVE-2026-17301 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves improper verification of a cryptographic signature, which could allow an unauthenticated attacker to bypass authentication controls.

CVE-2026-17299 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to perform arbitrary file reads and SSRF by exploiting insufficient restrictions on externally referenced content in submitted definitions. The vulnerability arises from unrestricted resolution of external references, which can lead to sensitive content being retrieved and returned to the attacker.

CVE-2026-17298 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make unauthorized requests, potentially leading to the exposure of sensitive information. The vulnerability has a CVSS score of 9.9, indicating a high impact on confidentiality, integrity, and availability.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain an open redirect vulnerability. This flaw allows a remote attacker to manipulate the redirect address during sign-in, which is not properly validated. Exploiting this could lead to an account takeover by redirecting authentication results to an attacker-controlled location.

CVE-2026-17296 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw allows a remote authenticated attacker to cause the server to make unauthorized requests, potentially leading to the exposure of sensitive information. The vulnerability has a high CVSS score of 9.6, indicating severe confidentiality and integrity impacts without affecting availability.

CVE-2026-17295 is a path traversal vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access sensitive information by exploiting improper validation of file paths.

CVE-2026-17294 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. A remote authenticated attacker could exploit this flaw to obtain sensitive information from the system. The vulnerability has a high severity with a CVSS score of 8.5.

CVE-2026-17293 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass authorization controls and modify user profile information due to broken object-level authorization. The access control checks fail to verify whether the user has permission to change the targeted profile.