CVE-20XX-?
agent?

Just published.

The newest CVEs, straight from CVE.org and NVD.

402,339 CVEs · updated 2026-11-10 16:28 UTC

  1. CVE-2026-17407

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.

    Injection Server

    8.5 HIGH 0.5% exploit odds No fix listed
  2. CVE-2026-17408

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.

    Injection

    9.8 CRITICAL 0.9% exploit odds No fix listed
  3. CVE-2026-17400

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.

    Injection Server

    7.7 HIGH 0.5% exploit odds No fix listed
  4. CVE-2026-17401

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.

    Memory safety Server

    7.2 HIGH 0.9% exploit odds No fix listed
  5. CVE-2026-17402

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.

    Injection Server

    9.9 CRITICAL 2% exploit odds No fix listed
  6. CVE-2026-17403

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.

    Auth & access Server

    9.0 CRITICAL 0.5% exploit odds No fix listed
  7. CVE-2026-17404

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server

    8.5 HIGH 0.4% exploit odds No fix listed
  8. CVE-2026-17396

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.

    Injection Server

    9.6 CRITICAL 0.5% exploit odds No fix listed
  9. CVE-2026-17397

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server

    8.5 HIGH 0.4% exploit odds No fix listed
  10. CVE-2026-17398

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server

    8.5 HIGH 0.4% exploit odds No fix listed
  11. CVE-2026-17399

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server.

    Code execution Server

    9.9 CRITICAL 0.8% exploit odds No fix listed
  12. CVE-2026-17392

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant.

    Injection Server

    9.9 CRITICAL 0.7% exploit odds No fix listed
  13. CVE-2026-17394

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should be controlled by the system, which could expose sensitive information.

    Other Server

    9.6 CRITICAL 0.5% exploit odds No fix listed
  14. CVE-2026-17395

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently restricted, which could allow the server to be made to contact internal systems.

    Disclosure Server

    6.4 MEDIUM 0.3% exploit odds No fix listed
  15. CVE-2026-17393

    IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a local attacker to obtain sensitive information due to the use of a cryptographically weak pseudo-random number generator.

    Crypto

    5.1 MEDIUM 0.1% exploit odds No fix listed
  16. CVE-2026-17387

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    7.7 HIGH 0.4% exploit odds No fix listed
  17. CVE-2026-17388

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    8.5 HIGH 0.4% exploit odds No fix listed
  18. CVE-2026-17389

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information from the connected LDAP directory due to LDAP injection. Input is not properly neutralized in directory lookups, which could cause queries to return additional data.

    Injection

    5.3 MEDIUM 0.4% exploit odds No fix listed
  19. CVE-2026-17390

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to execute arbitrary JavaScript in the web UI due to cross-site scripting. This could alter the intended functionality of the page and potentially lead to credential disclosure within a trusted session.

    XSS Web app

    6.4 MEDIUM 0.3% exploit odds No fix listed
  20. CVE-2026-17391

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    6.3 MEDIUM 0.4% exploit odds No fix listed
  21. CVE-2026-17382

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.

    Disclosure

    8.5 HIGH 0.6% exploit odds No fix listed
  22. CVE-2026-17383

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.

    Auth & access Server

    7.7 HIGH 0.4% exploit odds No fix listed
  23. CVE-2026-17385

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server

    8.5 HIGH 0.4% exploit odds No fix listed
  24. CVE-2026-17384

    IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.

    Disclosure Server

    8.5 HIGH 0.4% exploit odds No fix listed
  25. CVE-2026-17386

    IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote attacker to gain full administrative control due to the use of a cryptographically weak pseudo-random number generator.

    Crypto Server

    8.1 HIGH 0.5% exploit odds No fix listed
  26. CVE-2026-17377

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to forge audit records due to improper output neutralization for logs.

    Other Server

    5.0 MEDIUM 0.4% exploit odds No fix listed
  27. CVE-2026-17378

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    7.7 HIGH 0.4% exploit odds No fix listed
  28. CVE-2026-17379

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and assign arbitrary roles due to improper verification of cryptographic signatures.

    Crypto

    7.4 HIGH 0.3% exploit odds No fix listed
  29. CVE-2026-17380

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access sensitive information belonging to other tenants due to improper validation of a path parameter. A path value in a request is not sufficiently validated, which could allow a user to reach data outside their own tenant.

    Disclosure

    8.5 HIGH 0.5% exploit odds No fix listed
  30. CVE-2026-17381

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization validation using user-controlled keys.

    Auth & access

    8.5 HIGH 0.4% exploit odds No fix listed
  31. CVE-2026-17371

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    5.0 MEDIUM 0.3% exploit odds No fix listed
  32. CVE-2026-17372

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to probe internal network resources due to insufficient validation of webhook destination URLs. User-configured webhook addresses are not sufficiently restricted, so the server could be made to contact internal systems.

    Disclosure Server

    6.4 MEDIUM 0.3% exploit odds No fix listed
  33. CVE-2026-17373

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.

    Auth & access Server

    7.7 HIGH 0.4% exploit odds No fix listed
  34. CVE-2026-17374

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    7.7 HIGH 0.4% exploit odds No fix listed
  35. CVE-2026-17375

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization decisions rely on information supplied by the client, which could allow access to information the user should not see.

    Auth & access

    7.7 HIGH 0.4% exploit odds No fix listed
  36. CVE-2026-17376

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    7.7 HIGH 0.4% exploit odds No fix listed
  37. CVE-2026-17366

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    5.0 MEDIUM 0.3% exploit odds No fix listed
  38. CVE-2026-17367

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.

    Auth & access Server

    5.4 MEDIUM 0.3% exploit odds No fix listed
  39. CVE-2026-17368

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform network reconnaissance and obtain sensitive credentials due to server-side request forgery. The server can be made to send requests to unintended destinations and return the results.

    Disclosure Server

    6.8 MEDIUM 0.5% exploit odds No fix listed
  40. CVE-2026-17369

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link the victim's session to an account controlled by the attacker.

    Auth & access Web app

    5.4 MEDIUM 0.2% exploit odds No fix listed
  41. CVE-2026-17370

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain an access token for another user due to improper authentication. The sign-in flow does not sufficiently verify the identity of the user completing it, which could allow another user's identity to be assumed.

    Auth & access

    6.4 MEDIUM 0.4% exploit odds No fix listed
  42. CVE-2026-17359

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. A user-supplied value can influence code that the product generates, which could lead to code execution.

    Injection

    9.9 CRITICAL 0.9% exploit odds No fix listed
  43. CVE-2026-17360

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.

    Auth & access Server

    9.8 CRITICAL 0.6% exploit odds No fix listed
  44. CVE-2026-17361

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server

    7.7 HIGH 0.4% exploit odds No fix listed
  45. CVE-2026-17363

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.

    Injection Server

    7.7 HIGH 0.5% exploit odds No fix listed
  46. CVE-2026-17365

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server

    8.5 HIGH 0.4% exploit odds No fix listed
  47. CVE-2026-17354

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file writes due to path traversal.

    Disclosure Server

    9.9 CRITICAL 0.7% exploit odds No fix listed
  48. CVE-2026-17355

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from internal network resources due to server-side request forgery. Destination checks on outbound requests can be bypassed, which could allow the server to reach internal systems that should be blocked.

    Disclosure Server

    8.2 HIGH 0.4% exploit odds No fix listed
  49. CVE-2026-17356

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.

    Auth & access Server

    8.7 HIGH 0.3% exploit odds No fix listed
  50. CVE-2026-17357

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network services due to server-side request forgery.

    Disclosure Server

    7.6 HIGH 0.4% exploit odds No fix listed

The newest published CVE records from CVE.org and NVD, refreshed every few minutes, with severity, exploit odds and fix status.