Threats affecting pkg:generic/opencv

A critical path traversal vulnerability (CWE-22) exists in IBM API Connect versions 12.1.0.0 through 12.1.1.2. This flaw could allow a remote attacker to execute arbitrary code on the affected system without any privileges or user interaction. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-17339 is a critical path traversal vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access or delete resources belonging to other tenants. This vulnerability arises from improper validation of file paths, enabling unauthorized cross-tenant resource manipulation.

CVE-2026-17338 is a critical vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves broken object-level authorization that could allow a remote authenticated attacker to access sensitive information. The flaw is due to authorization bypass through a user-controlled key.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a race condition vulnerability that can allow a remote authenticated attacker to bypass authentication. This occurs due to improper and unreliable certificate validation, potentially permitting connections without proper authentication.

CVE-2026-17336 is a critical SQL Injection vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements in SQL queries. The vulnerability has a CVSS 3.1 score of 9.9, indicating high impact on confidentiality, integrity, and availability.

CVE-2026-17335 is a path traversal vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to write files outside the intended directory by exploiting insufficient validation of file paths in uploaded content, potentially leading to arbitrary code execution.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization bypass vulnerability due to improper authorization checks involving user-controlled keys. This flaw allows a remote authenticated attacker to access sensitive information without proper permissions.

CVE-2026-17333 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves improper certificate validation that could allow a remote attacker to bypass authentication and inject unauthorized configuration changes.

CVE-2026-17332 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves improper certificate validation that could allow a remote attacker to bypass security restrictions. This flaw affects the confidentiality and integrity of the system but does not impact availability. No public exploits or known active exploitation have been reported. No patch or remediation details are provided in the available data.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows remote attackers to read arbitrary files on the server by externally controlling the file name or path. This flaw is identified as CWE-73 and has a high severity rating with a CVSS score of 7.5.

CVE-2026-17330 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality significantly but has limited impact on integrity and no impact on availability.

CVE-2026-17329 is a critical Server-Side Request Forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote attacker to obtain sensitive information by exploiting improper validation of endpoint URLs.

CVE-2026-17328 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) issue caused by incomplete input validation, which could allow a remote authenticated attacker to bypass input checks and obtain sensitive information.

CVE-2026-17327 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality significantly but has limited impact on integrity and no impact on availability.

CVE-2026-17326 is an improper authentication vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass security restrictions, potentially leading to unauthorized access with high confidentiality and integrity impact but no availability impact.

CVE-2026-17325 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw where improper validation of user-supplied URLs allows a remote authenticated attacker to obtain sensitive information. The vulnerability has a CVSS 3.1 base score of 8.5, indicating significant confidentiality impact with limited integrity impact and no availability impact.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability due to missing authentication for a critical function. This flaw could allow a remote attacker to access sensitive configuration data and perform unauthorized actions without any authentication.

CVE-2026-17323 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves improper restriction of XML external entity references (XXE), which could allow a remote attacker to obtain sensitive information. The vulnerability does not require user interaction or privileges and has a low attack complexity. No known exploits are reported in the wild.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where sensitive information is inserted into log files. This flaw could allow a local attacker with limited privileges to access sensitive credentials from these logs and potentially compromise accounts.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization bypass vulnerability (CWE-639) that allows a remote authenticated attacker to delete or overwrite arbitrary control-plane assets. This occurs due to an insecure direct object reference flaw, enabling unauthorized modification of critical assets.