Critical severity threats

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain a vulnerability that allows a remote authenticated attacker to bypass authorization controls using user-controlled keys. This flaw enables the attacker to obtain sensitive information and modify arbitrary documents within the affected system.

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a server-side request forgery (SSRF) vulnerability that could allow a remote attacker to access internal network resources. This vulnerability has a high severity score of 9.3 and impacts confidentiality and integrity of the system.

The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress contains an arbitrary file upload vulnerability in all versions up to and including 2.13.2. This flaw allows unauthenticated attackers to upload and write PHP files to arbitrary locations outside the uploads directory, resulting in remote code execution. Exploitation requires the site option 'nbdesigner_upload_popup_style' to be set to 'a' (Advanced Upload Popup), which enables unauthenticated access to the vulnerable AJAX handler. The required nonce for the attack is publicly accessible on the frontend, making exploitation trivial once the configuration is active.

IBM API Connect versions 12.1.0.0 through 12.1.1.2 contain an authorization vulnerability that could allow a remote attacker to create, modify, or delete tenants without proper permissions. This flaw arises from missing authorization checks.

IBM Aspera Faspex versions 5.0.0 through 5.0.19 contain a vulnerability that allows an authorized user to bypass user authorization by crafting a specific message, resulting in full administrative privilege escalation.

The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race against an administrator saving its settings.

The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which can lead to a full site takeover.

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.

CVE-2026-18838 is a critical authentication bypass vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. The flaw arises from insufficient verification of identity information supplied in requests, allowing a remote attacker to impersonate other users. This can lead to unauthorized access to sensitive information and modification of API configurations.

CVE-2026-18836 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote attacker to make the affected component send requests to unintended destinations and receive the responses, potentially exposing sensitive information. The vulnerability has a high CVSS score of 9.3, indicating significant impact on confidentiality and integrity without requiring privileges or user interaction.

CVE-2026-17410 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves improper neutralization of argument delimiters (CWE-88), allowing a remote authenticated attacker to access and modify portal data belonging to other tenants. This flaw impacts confidentiality, integrity, and availability of affected systems.

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.

CVE-2026-17408 is a critical OS command injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote attacker to execute arbitrary code due to improper neutralization of special elements in OS commands.

CVE-2026-17403 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves the use of hard-coded credentials, which could allow a remote attacker to gain full administrative control of the affected system.

CVE-2026-17402 is a critical OS command injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary commands on the underlying host due to improper neutralization of user-supplied input before passing it to the operating system.

CVE-2026-17399 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It involves insufficient validation of uploaded file content, allowing a remote authenticated attacker to execute arbitrary code on the server. The flaw arises from unrestricted upload of files with dangerous types that are not properly checked before processing.

CVE-2026-17396 is a critical SQL injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information by exploiting improper input handling in SQL queries.

CVE-2026-17394 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to modify object attributes that should be system-controlled, potentially exposing sensitive information. The flaw involves improper control over dynamically-determined object attributes, enabling unauthorized changes to access-related settings.

CVE-2026-17392 is a critical LDAP injection vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to manipulate LDAP directory queries by injecting malicious input, potentially gaining unauthorized administrative access to other tenants. This vulnerability arises because user input is not properly sanitized before being used in directory queries, enabling privilege escalation across tenant boundaries.

CVE-2026-17360 is a critical vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves the use of hard-coded credentials that could allow a remote attacker to gain full administrative control of the affected system.