Critical severity threats

CVE-2026-17150 affects IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The vulnerability arises from insufficient input validation of uploaded custom module content, allowing a remote authenticated attacker to execute arbitrary code and access sensitive information across tenants.

CVE-2026-17147 is a critical path traversal vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw allows a remote authenticated attacker to execute arbitrary code and perform unauthorized administrative actions.

CVE-2026-17146 is a critical cross-site scripting (XSS) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw allows a remote authenticated attacker to execute arbitrary JavaScript code due to improper input validation, potentially leading to the exposure of sensitive information and full compromise of confidentiality, integrity, and availability.

CVE-2026-17134 is a critical SQL injection vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary SQL commands, potentially leading to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-17132 is a critical SQL Injection vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements in SQL queries.

CVE-2026-17131 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote attacker to bypass restrictions on outbound requests, causing the server to contact unintended destinations and potentially disclose sensitive information.

CVE-2026-17117 is a critical vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to execute arbitrary code by improperly controlling modification of dynamically-determined object attributes. Specifically, a user can set a field that should be system-controlled, leading to potential code execution.

CVE-2026-17066 is a critical vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves missing authorization controls that could allow a remote authenticated attacker to access sensitive information and modify or delete data belonging to other tenants. The flaw affects multi-tenant environments and poses a high risk to confidentiality, integrity, and availability of data.

CVE-2026-17049 is a critical vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass authorization controls by exploiting user-controlled keys, potentially leading to unauthorized access to sensitive information and modification of arbitrary documents.

CVE-2026-16920 is a critical confused deputy vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to bypass security restrictions, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-16918 is a critical server-side request forgery (SSRF) vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. This flaw allows a remote attacker to make the server access internal network resources, potentially leading to unauthorized information disclosure. The vulnerability has a high CVSS score of 9.3, indicating severe impact on confidentiality with limited impact on integrity and no impact on availability.

CVE-2026-16884 is a critical vulnerability in IBM API Connect versions 12.1.0.0 through 12.1.1.2. It involves improper restriction of XML external entity references (XXE), which could allow a remote attacker to obtain sensitive information. The vulnerability has a high CVSS score of 9.9, indicating severe impact including confidentiality and availability. No public exploits or vendor patches are currently documented in the provided data.

CVE-2026-16720 is a critical improper authentication vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The flaw allows a remote attacker to obtain valid access tokens for other users by exploiting insufficient enforcement of authentication against a connected directory service. This could enable the attacker to assume another user's identity with full access rights.

IBM Aspera Faspex versions 5.0.0 through 5.0.19 contain an authorization vulnerability that allows an authorized user to bypass normal user restrictions and gain full administrative privileges. This flaw is classified as CWE-863 (Incorrect Authorization) and has a critical severity rating with a CVSS score of 9.8.

The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress contains a critical arbitrary file upload vulnerability in versions up to and including 2.13.2. This flaw allows unauthenticated attackers to upload attacker-controlled PHP files outside the uploads directory via a vulnerable AJAX handler when a specific site option is enabled. Exploitation leads to remote code execution.

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to create, modify, or delete tenants due to missing authorization.

The payever WooCommerce Gateway plugin for WordPress up to version 4.8.0 contains an unrestricted file upload vulnerability that allows unauthenticated attackers to upload executable PHP files. This occurs because three API callbacks lack authentication and validation, enabling remote code execution. The vulnerability is critical with a CVSS score of 9.8.

A critical security vulnerability (CVE-2025-55754) affects the wso2mi package due to improper neutralization of escape, meta, or control sequences in Apache Tomcat. This flaw can lead to significant impact on confidentiality, integrity, and availability. Versions prior to 4.3.0-r0, 4.4.0-r0, and 4.5.0-r0 are affected. A patch is available in these fixed versions.

A critical security vulnerability (CVE-2025-59340) affects the wso2mi package due to an issue in jinjava, a Java-based template engine adapted from Django template syntax to render Jinja templates. The vulnerability has a CVSS score of 10.0, indicating it is exploitable remotely without authentication and can lead to complete confidentiality, integrity, and availability compromise. Fixed versions 4.3.0-r0, 4.4.0-r0, and 4.5.0-r0 are available.