Threats affecting pkg:generic/radare2

CVE-2026-17066 is a critical vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves missing authorization controls that could allow a remote authenticated attacker to access sensitive information and modify or delete data belonging to other tenants. The flaw affects multi-tenant environments and poses a high risk to confidentiality, integrity, and availability of data.

CVE-2026-17064 is a medium severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass authorization controls via an insecure direct object reference, potentially exposing sensitive information. The vulnerability does not impact integrity or availability, and no public exploits are known.

CVE-2026-17062 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves improper neutralization of argument delimiters, allowing a remote authenticated attacker to inject additional parameters into internal server requests by exploiting unsafe handling of special characters in user input. The vulnerability has a low severity rating with a CVSS score of 2.7.

CVE-2026-17049 is a critical vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass authorization controls by exploiting user-controlled keys, potentially leading to unauthorized access to sensitive information and modification of arbitrary documents.

CVE-2026-16920 is a critical confused deputy vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass security restrictions, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-16918 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw allows a remote attacker to make the server access internal network resources, potentially leading to unauthorized information disclosure. The vulnerability has a high CVSS score of 9.3, indicating severe impact on confidentiality with limited impact on integrity and no impact on availability.

CVE-2026-16912 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves a server-side request forgery (SSRF) flaw that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not require user interaction and impacts confidentiality with limited integrity impact and no availability impact.

CVE-2026-16884 is a critical vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves improper restriction of XML external entity references (XXE), which could allow a remote attacker to obtain sensitive information. The vulnerability has a high CVSS score of 9.9, indicating severe impact including confidentiality and availability. No public exploits or vendor patches are currently documented in the provided data.

CVE-2026-16880 is a path traversal vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access sensitive information by exploiting improper validation of file paths. The vulnerability has a high severity with a CVSS score of 8.5.

CVE-2026-16854 is a SQL Injection vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to exploit improper input neutralization in data queries, potentially exposing sensitive information from other tenants. The vulnerability does not impact data integrity or availability but can lead to unauthorized data disclosure.

CVE-2026-16720 is a critical improper authentication vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw allows a remote attacker to obtain valid access tokens for other users by exploiting insufficient enforcement of authentication against a connected directory service. This could enable the attacker to assume another user's identity with full access rights.

CVE-2026-16719 is a path traversal vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw allows a remote attacker with limited privileges to craft a URL request that accesses files outside the intended directory, potentially exposing sensitive information. The vulnerability has a medium severity with a CVSS score of 6.5 and impacts confidentiality without affecting integrity or availability.

CVE-2026-16718 is a path traversal vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access sensitive information by exploiting improper validation of file paths.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization bypass vulnerability (CWE-639) that allows a remote authenticated attacker to access sensitive information. This flaw arises from broken object-level authorization due to user-controlled keys. The vulnerability has a high severity with a CVSS score of 7.7.

CVE-2026-16716 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass security restrictions and access or modify sensitive information due to improper restriction of security token assignment.

CVE-2026-16715 is a high-severity vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass object-level authorization controls and access sensitive information belonging to other tenants. This flaw arises from broken object-level authorization related to user-controlled keys.

A path traversal vulnerability (CWE-22) exists in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw could allow a remote attacker to overwrite arbitrary files on the affected system.

CVE-2026-16712 is a high-severity authorization bypass vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to access sensitive information belonging to other tenants due to insufficient permission checks on identifiers supplied in requests.

CVE-2026-16711 is an authorization vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw involves insufficient input validation that may allow a remote attacker to inject platform credentials into outbound requests. This improper authorization could lead to unintended credential exposure. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-16710 is a server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to cause the server to make unauthorized requests, potentially leading to the exposure of sensitive information. The vulnerability has a medium severity with a CVSS score of 5.8.