Threats affecting pkg:generic/radare2

CVE-2026-17150 affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The vulnerability arises from insufficient input validation of uploaded custom module content, allowing a remote authenticated attacker to execute arbitrary code and access sensitive information across tenants.

CVE-2026-17147 is a critical path traversal vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw allows a remote authenticated attacker to execute arbitrary code and perform unauthorized administrative actions.

CVE-2026-17146 is a critical cross-site scripting (XSS) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw allows a remote authenticated attacker to execute arbitrary JavaScript code due to improper input validation, potentially leading to the exposure of sensitive information and full compromise of confidentiality, integrity, and availability.

CVE-2026-17144 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information due to improper input validation. The vulnerability has a medium severity with a CVSS score of 4.3.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to perform HTML injection. This is due to improper neutralization of user-supplied input, which could lead to injection of script-related HTML tags.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a code injection vulnerability (CWE-94) that allows a remote authenticated attacker with high privileges to influence code generation, potentially leading to arbitrary code execution. The vulnerability has a low CVSS score of 3.3, indicating limited impact and exploitability. No public exploits or known active exploitation have been reported. No patch or remediation information is provided in the available data.

CVE-2026-17139 is a cross-site scripting (XSS) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw allows a remote authenticated attacker to inject malicious scripts via certain URL fields that lack sufficient validation. This could enable script execution in another user's browser session, potentially leading to information disclosure or session manipulation.

CVE-2026-17137 is a medium severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves the generation of predictable initialization vectors (IVs) when using CBC mode encryption, resulting in weakened cryptographic protection of stored data. This flaw could allow a local attacker to obtain sensitive information due to improper cryptographic implementation.

CVE-2026-17134 is a critical SQL injection vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary SQL commands, potentially leading to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-17132 is a critical SQL Injection vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements in SQL queries.

CVE-2026-17131 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote attacker to bypass restrictions on outbound requests, causing the server to contact unintended destinations and potentially disclose sensitive information.

CVE-2026-17129 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves an authorization bypass due to an insecure direct object reference, allowing a remote authenticated attacker to access sensitive information and cause denial of service.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability where sensitive information may be inserted into log files. This could allow a remote authenticated attacker to access sensitive data through log file exposure. The vulnerability has a CVSS score of 6.8, indicating a medium severity level.

CVE-2026-17117 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary code by improperly controlling modification of dynamically-determined object attributes. Specifically, a user can set a field that should be system-controlled, leading to potential code execution.

CVE-2026-17114 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information and cause a denial of service by triggering error messages that expose sensitive data.

CVE-2026-17112 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls and access sensitive information belonging to other tenants. This flaw arises from broken authorization checks related to user-controlled keys.

CVE-2026-17108 is a high-severity vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves server-side request forgery (SSRF) that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not require user interaction and has a low attack complexity. It impacts confidentiality heavily but has limited impact on integrity and no impact on availability.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where verbose error messages may disclose sensitive information to remote attackers. This issue is classified under CWE-209, indicating that error messages reveal information that could aid an attacker. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-17085 affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The vulnerability arises from improper handling of case sensitivity in access restrictions, which allows a remote authenticated attacker to bypass security controls and send unauthorized emails. The flaw does not impact confidentiality or availability but can lead to limited integrity violations. The CVSS score is 4.1, indicating medium severity.

CVE-2026-17067 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access internal network resources by exploiting the SSRF flaw. The vulnerability has a medium severity with a CVSS score of 5.5.