Export limit exceeded: 202911 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 202911 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (202911 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-19131 | 1 Ibm | 1 Api Connect | 2026-11-08 | 6.5 Medium |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow low-privileged users to query arbitrary indices and read sensitive data due to missing authorization. | ||||
| CVE-2026-19128 | 1 Ibm | 1 Api Connect | 2026-11-08 | 7.5 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks. | ||||
| CVE-2026-19126 | 1 Ibm | 1 Api Connect | 2026-11-08 | 5.9 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. | ||||
| CVE-2026-19124 | 1 Ibm | 1 Api Connect | 2026-11-08 | 6.8 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 could allow an attacker with access to stored data to decrypt sensitive credentials due to the use of a hard-coded cryptographic key. The key protecting stored credentials is built into the product, so credentials could be decrypted if the stored data is obtained. | ||||
| CVE-2026-18689 | 1 Ibm | 1 Api Connect | 2026-11-08 | 4.3 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations. | ||||
| CVE-2026-18535 | 1 Ibm | 1 Api Connect | 2026-11-08 | 9.6 Critical |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators. | ||||
| CVE-2026-17428 | 1 Ibm | 1 Api Connect | 2026-11-08 | 5 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others. | ||||
| CVE-2026-17409 | 1 Ibm | 1 Api Connect | 2026-11-08 | 9.4 Critical |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached. | ||||
| CVE-2026-17400 | 1 Ibm | 1 Api Connect | 2026-11-08 | 7.7 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection. | ||||
| CVE-2026-17393 | 1 Ibm | 1 Api Connect | 2026-11-08 | 5.1 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a local attacker to obtain sensitive information due to the use of a cryptographically weak pseudo-random number generator. | ||||
| CVE-2026-17391 | 1 Ibm | 1 Api Connect | 2026-11-08 | 6.3 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. | ||||
| CVE-2026-17389 | 1 Ibm | 1 Api Connect | 2026-11-08 | 5.3 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information from the connected LDAP directory due to LDAP injection. Input is not properly neutralized in directory lookups, which could cause queries to return additional data. | ||||
| CVE-2026-17387 | 1 Ibm | 1 Api Connect | 2026-11-08 | 7.7 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. | ||||
| CVE-2026-17383 | 1 Ibm | 1 Api Connect | 2026-11-08 | 7.7 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization. | ||||
| CVE-2026-17378 | 1 Ibm | 1 Api Connect | 2026-11-08 | 7.7 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. | ||||
| CVE-2026-17376 | 1 Ibm | 1 Api Connect | 2026-11-08 | 7.7 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. | ||||
| CVE-2026-17375 | 1 Ibm | 1 Api Connect | 2026-11-08 | 7.7 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization decisions rely on information supplied by the client, which could allow access to information the user should not see. | ||||
| CVE-2026-17374 | 1 Ibm | 1 Api Connect | 2026-11-08 | 7.7 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. | ||||
| CVE-2026-17373 | 1 Ibm | 1 Api Connect | 2026-11-08 | 7.7 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. | ||||
| CVE-2026-17371 | 1 Ibm | 1 Api Connect | 2026-11-08 | 5 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. | ||||