Export limit exceeded: 420824 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 420824 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420824 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-17238 | 1 Ibm | 1 Api Connect | 2026-11-07 | 6.4 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to path parameter injection. Values in the request path are not sufficiently validated, which could allow access to data belonging to other tenants. | ||||
| CVE-2026-17237 | 1 Ibm | 1 Api Connect | 2026-11-07 | 6.4 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. | ||||
| CVE-2026-17236 | 1 Ibm | 1 Api Connect | 2026-11-07 | 6.4 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization checks are not applied when certain organization URLs are resolved, which could allow access to information belonging to others. | ||||
| CVE-2026-17233 | 1 Ibm | 1 Api Connect | 2026-11-07 | 6.4 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain information about internal network services due to improper validation of user-supplied URLs. Addresses supplied by users are not sufficiently restricted, so the server could be made to contact internal systems. | ||||
| CVE-2026-17232 | 1 Ibm | 1 Api Connect | 2026-11-07 | 6.1 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to improper neutralization of special elements in a request. Specially formed request parameters are not handled safely, which could allow protections to be circumvented. | ||||
| CVE-2026-17231 | 1 Ibm | 1 Api Connect | 2026-11-07 | 5.8 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an observable response discrepancy. | ||||
| CVE-2026-17230 | 1 Ibm | 1 Api Connect | 2026-11-07 | 5.4 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability. | ||||
| CVE-2026-17228 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.5 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Destination restrictions on outbound requests can be bypassed, which could allow the server to retrieve content from unintended resources. | ||||
| CVE-2026-17225 | 1 Ibm | 1 Api Connect | 2026-11-07 | 5.4 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions and access unauthorized analytics queries due to improper input validation. Request parameters are not validated sufficiently, which could allow restrictions on analytics data to be circumvented. | ||||
| CVE-2026-17215 | 1 Ibm | 1 Api Connect | 2026-11-07 | 4.3 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to verbose error messages. Error responses contain more information about the system than necessary, which could help an attacker learn about the environment. | ||||
| CVE-2026-17214 | 1 Ibm | 1 Api Connect | 2026-11-07 | 4.8 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to LDAP injection. | ||||
| CVE-2026-17211 | 1 Ibm | 1 Api Connect | 2026-11-07 | 4.3 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to cause a denial of service due to incorrect type conversion. A value is converted incorrectly between two different types, which could cause the service to return invalid responses or become unavailable. | ||||
| CVE-2026-17202 | 1 Ibm | 1 Api Connect | 2026-11-07 | 5.3 Medium |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to enumerate usernames due to observable differences in response behavior. | ||||
| CVE-2026-17190 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.7 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript due to cross-site scripting. HTML content supplied by a provider is not sufficiently sanitized before it is displayed, which could allow script content to run in the user's browser. | ||||
| CVE-2026-17188 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.5 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. When service definitions are imported, references to external resources are not sufficiently restricted, so the server could be made to request resources it should not access. | ||||
| CVE-2026-17187 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.5 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs. | ||||
| CVE-2026-17172 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.5 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to impersonate another party. | ||||
| CVE-2026-17167 | 1 Ibm | 1 Api Connect | 2026-11-07 | 4.3 Medium |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to falsify audit log information due to reliance on untrusted inputs. Information supplied by the client is relied on when recording the source of a request, so audit records could contain inaccurate details. | ||||
| CVE-2026-17158 | 1 Ibm | 1 Api Connect | 2026-11-07 | 9.9 Critical |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain elevated privileges due to improper authentication. | ||||
| CVE-2026-17155 | 1 Ibm | 1 Api Connect | 2026-11-07 | 5.4 Medium |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of user-controlled input. | ||||