Export limit exceeded: 420802 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420802 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-19124 | 1 Ibm | 1 Api Connect | 2026-11-07 | 6.8 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 could allow an attacker with access to stored data to decrypt sensitive credentials due to the use of a hard-coded cryptographic key. The key protecting stored credentials is built into the product, so credentials could be decrypted if the stored data is obtained. | ||||
| CVE-2026-17393 | 1 Ibm | 1 Api Connect | 2026-11-07 | 5.1 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a local attacker to obtain sensitive information due to the use of a cryptographically weak pseudo-random number generator. | ||||
| CVE-2026-17386 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.1 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote attacker to gain full administrative control due to the use of a cryptographically weak pseudo-random number generator. | ||||
| CVE-2026-17384 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.5 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability. | ||||
| CVE-2026-75590 | 1 Ibm | 1 Api Connect | 2026-11-07 | 7.2 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources and obtain sensitive information due to server-side request forgery. A protection that blocks requests to internal addresses can be bypassed, so the server could be made to contact internal services and return part of their responses. | ||||
| CVE-2026-19131 | 1 Ibm | 1 Api Connect | 2026-11-07 | 6.5 Medium |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow low-privileged users to query arbitrary indices and read sensitive data due to missing authorization. | ||||
| CVE-2026-19129 | 1 Ibm | 1 Api Connect | 2026-11-07 | 6.8 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a network-positioned attacker to intercept backup data due to improper verification of the backup server's identity. The identity of the backup server is not verified when the secure connection for analytics backups is established, which could allow backup data, and credentials if used, to be intercepted. | ||||
| CVE-2026-19128 | 1 Ibm | 1 Api Connect | 2026-11-07 | 7.5 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks. | ||||
| CVE-2026-19126 | 1 Ibm | 1 Api Connect | 2026-11-07 | 5.9 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. | ||||
| CVE-2026-19122 | 1 Ibm | 1 Api Connect | 2026-11-07 | 3.8 Low |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated privileged attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks. | ||||
| CVE-2026-19121 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.3 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources. | ||||
| CVE-2026-18838 | 1 Ibm | 1 Api Connect | 2026-11-07 | 9.4 Critical |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which could allow a caller to impersonate another user. | ||||
| CVE-2026-18836 | 1 Ibm | 1 Api Connect | 2026-11-07 | 9.3 Critical |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker. | ||||
| CVE-2026-18689 | 1 Ibm | 1 Api Connect | 2026-11-07 | 4.3 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations. | ||||
| CVE-2026-17428 | 1 Ibm | 1 Api Connect | 2026-11-07 | 5 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others. | ||||
| CVE-2026-17411 | 1 Ibm | 1 Api Connect | 2026-11-07 | 7.6 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries. | ||||
| CVE-2026-17410 | 1 Ibm | 1 Api Connect | 2026-11-07 | 9.9 Critical |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters. | ||||
| CVE-2026-17409 | 1 Ibm | 1 Api Connect | 2026-11-07 | 9.4 Critical |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached. | ||||
| CVE-2026-17408 | 1 Ibm | 1 Api Connect | 2026-11-07 | 9.8 Critical |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command. | ||||
| CVE-2026-17407 | 1 Ibm | 1 Api Connect | 2026-11-07 | 8.5 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run. | ||||