CVE-20XX-?
agent?

Just published.

The newest CVEs, straight from CVE.org and NVD.

402,378 CVEs · updated 2026-11-10 16:40 UTC

  1. CVE-2026-17392

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant.

    Injection Server

    9.9 CRITICAL 0.7% exploit odds No fix listed
  2. CVE-2026-17394

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should be controlled by the system, which could expose sensitive information.

    Other Server

    9.6 CRITICAL 0.5% exploit odds No fix listed
  3. CVE-2026-17395

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently restricted, which could allow the server to be made to contact internal systems.

    Disclosure Server

    6.4 MEDIUM 0.3% exploit odds No fix listed
  4. CVE-2026-17393

    IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a local attacker to obtain sensitive information due to the use of a cryptographically weak pseudo-random number generator.

    Crypto

    5.1 MEDIUM 0.1% exploit odds No fix listed
  5. CVE-2026-17387

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    7.7 HIGH 0.4% exploit odds No fix listed
  6. CVE-2026-17388

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    8.5 HIGH 0.4% exploit odds No fix listed
  7. CVE-2026-17389

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information from the connected LDAP directory due to LDAP injection. Input is not properly neutralized in directory lookups, which could cause queries to return additional data.

    Injection

    5.3 MEDIUM 0.4% exploit odds No fix listed
  8. CVE-2026-17390

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to execute arbitrary JavaScript in the web UI due to cross-site scripting. This could alter the intended functionality of the page and potentially lead to credential disclosure within a trusted session.

    XSS Web app

    6.4 MEDIUM 0.3% exploit odds No fix listed
  9. CVE-2026-17391

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    6.3 MEDIUM 0.4% exploit odds No fix listed
  10. CVE-2026-17382

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.

    Disclosure

    8.5 HIGH 0.6% exploit odds No fix listed
  11. CVE-2026-17383

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.

    Auth & access Server

    7.7 HIGH 0.4% exploit odds No fix listed
  12. CVE-2026-17385

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server

    8.5 HIGH 0.4% exploit odds No fix listed
  13. CVE-2026-17384

    IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.

    Disclosure Server

    8.5 HIGH 0.4% exploit odds No fix listed
  14. CVE-2026-17386

    IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote attacker to gain full administrative control due to the use of a cryptographically weak pseudo-random number generator.

    Crypto Server

    8.1 HIGH 0.5% exploit odds No fix listed
  15. CVE-2026-17377

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to forge audit records due to improper output neutralization for logs.

    Other Server

    5.0 MEDIUM 0.4% exploit odds No fix listed
  16. CVE-2026-17378

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    7.7 HIGH 0.4% exploit odds No fix listed
  17. CVE-2026-17379

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and assign arbitrary roles due to improper verification of cryptographic signatures.

    Crypto

    7.4 HIGH 0.3% exploit odds No fix listed
  18. CVE-2026-17380

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access sensitive information belonging to other tenants due to improper validation of a path parameter. A path value in a request is not sufficiently validated, which could allow a user to reach data outside their own tenant.

    Disclosure

    8.5 HIGH 0.5% exploit odds No fix listed
  19. CVE-2026-17381

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization validation using user-controlled keys.

    Auth & access

    8.5 HIGH 0.4% exploit odds No fix listed
  20. CVE-2026-17371

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    5.0 MEDIUM 0.3% exploit odds No fix listed
  21. CVE-2026-17372

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to probe internal network resources due to insufficient validation of webhook destination URLs. User-configured webhook addresses are not sufficiently restricted, so the server could be made to contact internal systems.

    Disclosure Server

    6.4 MEDIUM 0.3% exploit odds No fix listed
  22. CVE-2026-17373

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.

    Auth & access Server

    7.7 HIGH 0.4% exploit odds No fix listed
  23. CVE-2026-17374

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    7.7 HIGH 0.4% exploit odds No fix listed
  24. CVE-2026-17375

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization decisions rely on information supplied by the client, which could allow access to information the user should not see.

    Auth & access

    7.7 HIGH 0.4% exploit odds No fix listed
  25. CVE-2026-17376

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    7.7 HIGH 0.4% exploit odds No fix listed
  26. CVE-2026-17366

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    5.0 MEDIUM 0.3% exploit odds No fix listed
  27. CVE-2026-17367

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.

    Auth & access Server

    5.4 MEDIUM 0.3% exploit odds No fix listed
  28. CVE-2026-17368

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform network reconnaissance and obtain sensitive credentials due to server-side request forgery. The server can be made to send requests to unintended destinations and return the results.

    Disclosure Server

    6.8 MEDIUM 0.5% exploit odds No fix listed
  29. CVE-2026-17369

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link the victim's session to an account controlled by the attacker.

    Auth & access Web app

    5.4 MEDIUM 0.2% exploit odds No fix listed
  30. CVE-2026-17370

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain an access token for another user due to improper authentication. The sign-in flow does not sufficiently verify the identity of the user completing it, which could allow another user's identity to be assumed.

    Auth & access

    6.4 MEDIUM 0.4% exploit odds No fix listed
  31. CVE-2026-17359

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. A user-supplied value can influence code that the product generates, which could lead to code execution.

    Injection

    9.9 CRITICAL 0.9% exploit odds No fix listed
  32. CVE-2026-17360

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.

    Auth & access Server

    9.8 CRITICAL 0.6% exploit odds No fix listed
  33. CVE-2026-17361

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server

    7.7 HIGH 0.4% exploit odds No fix listed
  34. CVE-2026-17363

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.

    Injection Server

    7.7 HIGH 0.5% exploit odds No fix listed
  35. CVE-2026-17365

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server

    8.5 HIGH 0.4% exploit odds No fix listed
  36. CVE-2026-17354

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file writes due to path traversal.

    Disclosure Server

    9.9 CRITICAL 0.7% exploit odds No fix listed
  37. CVE-2026-17355

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from internal network resources due to server-side request forgery. Destination checks on outbound requests can be bypassed, which could allow the server to reach internal systems that should be blocked.

    Disclosure Server

    8.2 HIGH 0.4% exploit odds No fix listed
  38. CVE-2026-17356

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.

    Auth & access Server

    8.7 HIGH 0.3% exploit odds No fix listed
  39. CVE-2026-17357

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network services due to server-side request forgery.

    Disclosure Server

    7.6 HIGH 0.4% exploit odds No fix listed
  40. CVE-2026-17358

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication across tenants due to improper authentication. Authentication checks are not sufficiently isolated between tenants, which could allow a user from one tenant to be accepted by another.

    Auth & access

    8.2 HIGH 0.5% exploit odds No fix listed
  41. CVE-2026-17343

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authorization checks to access or modify sensitive information due to improper authorization.

    Auth & access Server

    8.1 HIGH 0.5% exploit odds No fix listed
  42. CVE-2026-17344

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. A service that can be reached without authentication could be made to send requests to unintended destinations.

    Disclosure Server

    9.3 CRITICAL 0.5% exploit odds No fix listed
  43. CVE-2026-17345

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.

    Injection Server

    7.7 HIGH 0.5% exploit odds No fix listed
  44. CVE-2026-17352

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server

    8.5 HIGH 0.4% exploit odds No fix listed
  45. CVE-2026-17353

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to server-side request forgery.

    Disclosure Server

    9.6 CRITICAL 0.5% exploit odds No fix listed
  46. CVE-2026-17338

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access

    9.1 CRITICAL 0.4% exploit odds No fix listed
  47. CVE-2026-17339

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access or delete resources belonging to other tenants due to path traversal.

    Disclosure Server

    9.1 CRITICAL 0.5% exploit odds No fix listed
  48. CVE-2026-17340

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to a path traversal vulnerability.

    Disclosure

    9.8 CRITICAL 0.9% exploit odds No fix listed
  49. CVE-2026-17341

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform server-side request forgery and relay unauthorized email messages due to improper neutralization of user-supplied input.

    Disclosure Server

    7.2 HIGH 0.3% exploit odds No fix listed
  50. CVE-2026-17342

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.

    Injection

    9.9 CRITICAL 0.9% exploit odds No fix listed

The newest published CVE records from CVE.org and NVD, refreshed every few minutes, with severity, exploit odds and fix status.