CVE-20XX-?
agent?

Just published.

The newest CVEs, straight from CVE.org and NVD.

402,534 CVEs · updated 2026-11-10 18:22 UTC

  1. CVE-2026-17294

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server IBM Api Connect

    8.5 HIGH 0.4% exploit odds Fix listed
  2. CVE-2026-17295

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.

    Disclosure IBM Api Connect

    7.7 HIGH 0.7% exploit odds Fix listed
  3. CVE-2026-17287

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. User-supplied addresses are not sufficiently validated, so the server could be made to send requests to unintended destinations and return the results.

    Disclosure Server IBM Api Connect

    8.5 HIGH 0.4% exploit odds Fix listed
  4. CVE-2026-17288

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server IBM Api Connect

    8.5 HIGH 0.4% exploit odds Fix listed
  5. CVE-2026-17289

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server IBM Api Connect

    7.7 HIGH 0.4% exploit odds Fix listed
  6. CVE-2026-17290

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to create unauthorized user accounts due to improper verification of cryptographic signatures. Identity information from a login provider is accepted without its signature being fully verified, so forged identity data could be used to create accounts.

    Crypto IBM Api Connect

    8.5 HIGH 0.4% exploit odds Fix listed
  7. CVE-2026-17281

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server IBM Api Connect

    7.7 HIGH 0.4% exploit odds Fix listed
  8. CVE-2026-17282

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server IBM Api Connect

    7.7 HIGH 0.4% exploit odds Fix listed
  9. CVE-2026-17283

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server IBM Api Connect

    7.7 HIGH 0.4% exploit odds Fix listed
  10. CVE-2026-17284

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform unauthorized operations in other tenants' environments due to improper validation of client-supplied information. Tenant context is not sufficiently verified, which could allow actions on resources belonging to other tenants.

    Auth & access IBM Api Connect

    7.1 HIGH 0.3% exploit odds Fix listed
  11. CVE-2026-17285

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of external references. When schemas are validated, references to external resources are not sufficiently restricted, which could allow the server to retrieve content it should not access.

    Disclosure Server IBM Api Connect

    7.7 HIGH 0.4% exploit odds Fix listed
  12. CVE-2026-17241

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.

    Auth & access Server IBM Api Connect

    6.5 MEDIUM 0.4% exploit odds Fix listed
  13. CVE-2026-17244

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform unauthorized actions and obtain sensitive information due to missing authorization. Certain operations do not verify that the user is permitted to act on the targeted resource, which could allow other users' API keys to be deleted.

    Auth & access IBM Api Connect

    7.4 HIGH 0.3% exploit odds Fix listed
  14. CVE-2026-17278

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain unauthorized access to sensitive API catalog and runtime configuration data due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to appear as a trusted party.

    Auth & access IBM Api Connect

    9.8 CRITICAL 0.7% exploit odds Fix listed
  15. CVE-2026-17279

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption. Certain requests can cause internal processing to stall, which could make the service unavailable.

    Denial of service Server IBM Api Connect

    7.7 HIGH 0.5% exploit odds Fix listed
  16. CVE-2026-17280

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform unauthenticated brute-force attacks to obtain valid credentials due to improper restriction of excessive authentication attempts.

    Auth & access Server IBM Api Connect

    8.9 HIGH 0.5% exploit odds Fix listed
  17. CVE-2026-17236

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization checks are not applied when certain organization URLs are resolved, which could allow access to information belonging to others.

    Auth & access IBM Api Connect

    6.4 MEDIUM 0.3% exploit odds Fix listed
  18. CVE-2026-17237

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server IBM Api Connect

    6.4 MEDIUM 0.3% exploit odds Fix listed
  19. CVE-2026-17238

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to path parameter injection. Values in the request path are not sufficiently validated, which could allow access to data belonging to other tenants.

    Disclosure Server IBM Api Connect

    6.4 MEDIUM 0.3% exploit odds Fix listed
  20. CVE-2026-17239

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a path traversal vulnerability.

    Disclosure IBM Api Connect

    9.9 CRITICAL 0.8% exploit odds Fix listed
  21. CVE-2026-17240

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to improper authentication. Authentication checks are not applied consistently, which could allow protected resources to be reached without valid credentials.

    Auth & access Server IBM Api Connect

    6.5 MEDIUM 0.6% exploit odds Fix listed
  22. CVE-2026-17228

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Destination restrictions on outbound requests can be bypassed, which could allow the server to retrieve content from unintended resources.

    Disclosure Server

    8.5 HIGH 0.4% exploit odds No fix listed
  23. CVE-2026-17230

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.

    Disclosure IBM Api Connect

    5.4 MEDIUM 0.5% exploit odds Fix listed
  24. CVE-2026-17231

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an observable response discrepancy.

    Disclosure IBM Api Connect

    5.8 MEDIUM 0.4% exploit odds Fix listed
  25. CVE-2026-17232

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to improper neutralization of special elements in a request. Specially formed request parameters are not handled safely, which could allow protections to be circumvented.

    Disclosure IBM Api Connect

    6.1 MEDIUM 0.3% exploit odds Fix listed
  26. CVE-2026-17233

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain information about internal network services due to improper validation of user-supplied URLs. Addresses supplied by users are not sufficiently restricted, so the server could be made to contact internal systems.

    Disclosure Server IBM Api Connect

    6.4 MEDIUM 0.3% exploit odds Fix listed
  27. CVE-2026-17202

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to enumerate usernames due to observable differences in response behavior.

    Other IBM Api Connect

    5.3 MEDIUM 0.4% exploit odds Fix listed
  28. CVE-2026-17211

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to cause a denial of service due to incorrect type conversion. A value is converted incorrectly between two different types, which could cause the service to return invalid responses or become unavailable.

    Denial of service

    4.3 MEDIUM 0.5% exploit odds No fix listed
  29. CVE-2026-17214

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to LDAP injection.

    Injection Server

    4.8 MEDIUM 0.3% exploit odds No fix listed
  30. CVE-2026-17215

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to verbose error messages. Error responses contain more information about the system than necessary, which could help an attacker learn about the environment.

    Disclosure IBM Api Connect

    4.3 MEDIUM 0.4% exploit odds Fix listed
  31. CVE-2026-17225

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions and access unauthorized analytics queries due to improper input validation. Request parameters are not validated sufficiently, which could allow restrictions on analytics data to be circumvented.

    Other IBM Api Connect

    5.4 MEDIUM 0.3% exploit odds Fix listed
  32. CVE-2026-17167

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to falsify audit log information due to reliance on untrusted inputs. Information supplied by the client is relied on when recording the source of a request, so audit records could contain inaccurate details.

    Other

    4.3 MEDIUM 0.3% exploit odds No fix listed
  33. CVE-2026-17172

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to impersonate another party.

    Auth & access

    8.5 HIGH 0.6% exploit odds No fix listed
  34. CVE-2026-17187

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.

    Disclosure

    8.5 HIGH 0.4% exploit odds No fix listed
  35. CVE-2026-17188

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. When service definitions are imported, references to external resources are not sufficiently restricted, so the server could be made to request resources it should not access.

    Disclosure Server IBM Api Connect

    8.5 HIGH 0.4% exploit odds Fix listed
  36. CVE-2026-17190

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript due to cross-site scripting. HTML content supplied by a provider is not sufficiently sanitized before it is displayed, which could allow script content to run in the user's browser.

    XSS Web app IBM Api Connect

    8.7 HIGH 0.4% exploit odds Fix listed
  37. CVE-2026-17147

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and perform unauthorized administrative actions due to a path traversal vulnerability.

    Disclosure Server IBM Api Connect

    9.9 CRITICAL 0.9% exploit odds Fix listed
  38. CVE-2026-17150

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants due to insufficient input validation. Uploaded custom module content is not sufficiently validated before it is processed, which could allow code to run with access beyond the user's own tenant.

    Code execution Library IBM Api Connect

    9.9 CRITICAL 0.8% exploit odds Fix listed
  39. CVE-2026-17154

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform cross-site scripting due to improper neutralization of user-supplied input.

    XSS Web app

    5.4 MEDIUM 0.3% exploit odds No fix listed
  40. CVE-2026-17155

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of user-controlled input.

    XSS

    5.4 MEDIUM 0.3% exploit odds No fix listed
  41. CVE-2026-17158

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain elevated privileges due to improper authentication.

    Auth & access Server

    9.9 CRITICAL 0.7% exploit odds No fix listed
  42. CVE-2026-17139

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. Certain URL fields are not sufficiently validated, so malicious script content could run in another user's browser session.

    XSS Browser & mail

    5.4 MEDIUM 0.3% exploit odds No fix listed
  43. CVE-2026-17140

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. Input supplied by a user can influence code generated by the product, which could lead to code execution.

    Injection

    3.3 LOW 0.4% exploit odds No fix listed
  44. CVE-2026-17143

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform HTML injection due to improper neutralization of user-supplied input.

    XSS Web app

    4.3 MEDIUM 0.4% exploit odds No fix listed
  45. CVE-2026-17144

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.

    Disclosure

    4.3 MEDIUM 0.4% exploit odds No fix listed
  46. CVE-2026-17146

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information due to improper input validation.

    XSS

    9.9 CRITICAL 0.7% exploit odds No fix listed
  47. CVE-2026-17129

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an insecure direct object reference.

    Auth & access Server

    7.6 HIGH 0.4% exploit odds No fix listed
  48. CVE-2026-17131

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to contact unintended destinations and return the response.

    Disclosure Server

    9.3 CRITICAL 0.4% exploit odds No fix listed
  49. CVE-2026-17132

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

    Injection Server

    9.9 CRITICAL 0.6% exploit odds No fix listed
  50. CVE-2026-17134

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection.

    Injection Server

    9.9 CRITICAL 0.5% exploit odds No fix listed

The newest published CVE records from CVE.org and NVD, refreshed every few minutes, with severity, exploit odds and fix status.