CVE-20XX-?
agent?

Just published.

The newest CVEs, straight from CVE.org and NVD.

402,381 CVEs · updated 2026-11-10 16:51 UTC

  1. CVE-2026-17340

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to a path traversal vulnerability.

    Disclosure

    9.8 CRITICAL 0.9% exploit odds No fix listed
  2. CVE-2026-17341

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform server-side request forgery and relay unauthorized email messages due to improper neutralization of user-supplied input.

    Disclosure Server

    7.2 HIGH 0.3% exploit odds No fix listed
  3. CVE-2026-17342

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.

    Injection

    9.9 CRITICAL 0.9% exploit odds No fix listed
  4. CVE-2026-17333

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and inject unauthorized configuration changes due to improper certificate validation.

    Crypto Server

    8.0 HIGH 0.2% exploit odds No fix listed
  5. CVE-2026-17334

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization via user-controlled keys.

    Auth & access

    8.5 HIGH 0.4% exploit odds No fix listed
  6. CVE-2026-17335

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to path traversal. File paths in uploaded content are not sufficiently validated, which could allow files to be written outside the intended location and code to be executed.

    Disclosure

    8.8 HIGH 0.8% exploit odds No fix listed
  7. CVE-2026-17336

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

    Injection Server

    9.9 CRITICAL 0.6% exploit odds No fix listed
  8. CVE-2026-17337

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication due to improper certificate validation. A certificate check is not performed reliably in all cases, which could allow a connection to be accepted without proper authentication.

    Crypto Server

    7.4 HIGH 0.2% exploit odds No fix listed
  9. CVE-2026-17328

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. Input checks are incomplete, which could allow them to be bypassed.

    Disclosure

    8.5 HIGH 0.4% exploit odds No fix listed
  10. CVE-2026-17329

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to improper validation of endpoint URLs.

    Disclosure

    9.3 CRITICAL 0.4% exploit odds No fix listed
  11. CVE-2026-17330

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server

    8.5 HIGH 0.4% exploit odds No fix listed
  12. CVE-2026-17331

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to read arbitrary files on the server due to external control of a file name or path.

    Disclosure Server

    7.5 HIGH 0.5% exploit odds No fix listed
  13. CVE-2026-17332

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to improper certificate validation.

    Crypto

    8.7 HIGH 0.3% exploit odds No fix listed
  14. CVE-2026-17323

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to XML external entity (XXE) injection.

    Other Server

    8.2 HIGH 0.6% exploit odds No fix listed
  15. CVE-2026-17324

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access sensitive configuration data and perform unauthorized actions due to missing authentication for a critical function.

    Auth & access Server

    8.3 HIGH 0.5% exploit odds No fix listed
  16. CVE-2026-17325

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.

    Disclosure

    8.5 HIGH 0.4% exploit odds No fix listed
  17. CVE-2026-17326

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.

    Auth & access

    8.1 HIGH 0.6% exploit odds No fix listed
  18. CVE-2026-17327

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server

    8.5 HIGH 0.4% exploit odds No fix listed
  19. CVE-2026-17318

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.

    Auth & access Server

    7.7 HIGH 0.4% exploit odds No fix listed
  20. CVE-2026-17319

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify tool configuration and cause a denial of service due to improper authorization. Information supplied by the client is relied on when deciding what a user is allowed to do, which could allow unauthorized changes that disrupt service.

    Auth & access

    7.1 HIGH 0.2% exploit odds No fix listed
  21. CVE-2026-17320

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to an insecure direct object reference.

    Auth & access

    7.7 HIGH 0.4% exploit odds No fix listed
  22. CVE-2026-17321

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to delete or overwrite arbitrary control-plane assets due to an insecure direct object reference.

    Auth & access Server

    8.1 HIGH 0.5% exploit odds No fix listed
  23. CVE-2026-17322

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive credentials and compromise accounts due to insertion of sensitive information into log files.

    Disclosure Server

    7.1 HIGH 0.2% exploit odds No fix listed
  24. CVE-2026-17313

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and take control of gateway configuration due to authentication bypass via an alternate path.

    Auth & access

    9.8 CRITICAL 0.8% exploit odds No fix listed
  25. CVE-2026-17314

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server

    5.0 MEDIUM 0.3% exploit odds No fix listed
  26. CVE-2026-17315

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to improper validation of user-supplied URLs.

    Disclosure

    5.8 MEDIUM 0.4% exploit odds No fix listed
  27. CVE-2026-17316

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform server-side request forgery due to improper validation of user-supplied input.

    Disclosure Server

    7.2 HIGH 0.3% exploit odds No fix listed
  28. CVE-2026-17317

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal resources and cause a denial of service due to server-side request forgery.

    Disclosure Server

    6.4 MEDIUM 0.4% exploit odds No fix listed
  29. CVE-2026-17307

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    6.5 MEDIUM 0.4% exploit odds No fix listed
  30. CVE-2026-17308

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive credentials and manipulate tool responses due to improper certificate validation.

    Crypto

    6.8 MEDIUM 0.1% exploit odds No fix listed
  31. CVE-2026-17309

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and tamper with configuration due to improper certificate validation.

    Crypto

    8.0 HIGH 0.1% exploit odds No fix listed
  32. CVE-2026-17310

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.

    Auth & access Server

    6.5 MEDIUM 0.3% exploit odds No fix listed
  33. CVE-2026-17311

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify application API subscriptions due to broken object-level authorization.

    Auth & access

    7.1 HIGH 0.4% exploit odds No fix listed
  34. CVE-2026-17312

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link the victim's session to an account controlled by the attacker.

    Auth & access Web app

    5.4 MEDIUM 0.2% exploit odds No fix listed
  35. CVE-2026-17302

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to probe internal network services due to improper validation of a user-supplied URL.

    Disclosure IBM Api Connect

    5.0 MEDIUM 0.3% exploit odds Fix listed
  36. CVE-2026-17303

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. The address is not sufficiently restricted, which could allow the server to contact internal systems.

    Disclosure Server

    6.4 MEDIUM 0.3% exploit odds No fix listed
  37. CVE-2026-17304

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. Locations supplied when service definitions are imported are not sufficiently validated, which could allow the server to retrieve content it should not access.

    Disclosure Server IBM Api Connect

    6.4 MEDIUM 0.3% exploit odds Fix listed
  38. CVE-2026-17305

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server IBM Api Connect

    5.5 MEDIUM 0.3% exploit odds Fix listed
  39. CVE-2026-17306

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information from internal network resources due to server-side request forgery.

    Disclosure Server IBM Api Connect

    5.8 MEDIUM 0.4% exploit odds Fix listed
  40. CVE-2026-17296

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server IBM Api Connect

    9.6 CRITICAL 0.4% exploit odds Fix listed
  41. CVE-2026-17297

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform an account takeover due to an open redirect vulnerability. The redirect address used during sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.

    Auth & access IBM Api Connect

    9.6 CRITICAL 0.6% exploit odds Fix listed
  42. CVE-2026-17298

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server IBM Api Connect

    9.9 CRITICAL 0.5% exploit odds Fix listed
  43. CVE-2026-17299

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file reads and server-side request forgery due to unrestricted resolution of external references. Externally referenced content in submitted definitions is not sufficiently restricted when processed, and the retrieved content could be returned to the attacker.

    Disclosure Server IBM Api Connect

    9.6 CRITICAL 0.4% exploit odds Fix listed
  44. CVE-2026-17301

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an unauthenticated attacker to bypass authentication due to improper verification of a cryptographic signature.

    Crypto IBM Api Connect

    9.8 CRITICAL 0.4% exploit odds Fix listed
  45. CVE-2026-17291

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform account takeover due to an open redirect vulnerability. The redirect address used during OAuth 2.0 sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.

    Auth & access IBM Api Connect

    8.7 HIGH 0.5% exploit odds Fix listed
  46. CVE-2026-17292

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to take over ownership of other organizations due to broken object-level authorization. Access checks on organization objects are incomplete, which could allow ownership of organizations the user does not control to be changed.

    Auth & access IBM Api Connect

    9.1 CRITICAL 0.4% exploit odds Fix listed
  47. CVE-2026-17293

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify user profile information due to broken object-level authorization. Access checks do not confirm that the user is permitted to change the targeted profile.

    Auth & access IBM Api Connect

    8.5 HIGH 0.4% exploit odds Fix listed
  48. CVE-2026-17294

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server IBM Api Connect

    8.5 HIGH 0.4% exploit odds Fix listed
  49. CVE-2026-17295

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.

    Disclosure IBM Api Connect

    7.7 HIGH 0.7% exploit odds Fix listed
  50. CVE-2026-17287

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. User-supplied addresses are not sufficiently validated, so the server could be made to send requests to unintended destinations and return the results.

    Disclosure Server

    8.5 HIGH 0.4% exploit odds No fix listed

The newest published CVE records from CVE.org and NVD, refreshed every few minutes, with severity, exploit odds and fix status.