CVE-20XX-?
agent?

Just published.

The newest CVEs, straight from CVE.org and NVD.

404,772 CVEs · updated 2026-11-12 06:07 UTC

  1. CVE-2026-17389

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information from the connected LDAP directory due to LDAP injection. Input is not properly neutralized in directory lookups, which could cause queries to return additional data.

    Injection

    5.3 MEDIUM 0.4% exploit odds No fix listed
  2. CVE-2026-17390

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to execute arbitrary JavaScript in the web UI due to cross-site scripting. This could alter the intended functionality of the page and potentially lead to credential disclosure within a trusted session.

    XSS Web app

    6.4 MEDIUM 0.3% exploit odds No fix listed
  3. CVE-2026-17391

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    6.3 MEDIUM 0.4% exploit odds No fix listed
  4. CVE-2026-17382

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.

    Disclosure

    8.5 HIGH 0.6% exploit odds No fix listed
  5. CVE-2026-17383

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.

    Auth & access Server

    7.7 HIGH 0.4% exploit odds No fix listed
  6. CVE-2026-17385

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server

    8.5 HIGH 0.4% exploit odds No fix listed
  7. CVE-2026-17384

    IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.

    Disclosure Server

    8.5 HIGH 0.4% exploit odds No fix listed
  8. CVE-2026-17386

    IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote attacker to gain full administrative control due to the use of a cryptographically weak pseudo-random number generator.

    Crypto Server

    8.1 HIGH 0.5% exploit odds No fix listed
  9. CVE-2026-17377

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to forge audit records due to improper output neutralization for logs.

    Other Server

    5.0 MEDIUM 0.4% exploit odds No fix listed
  10. CVE-2026-17378

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    7.7 HIGH 0.4% exploit odds No fix listed
  11. CVE-2026-17379

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and assign arbitrary roles due to improper verification of cryptographic signatures.

    Crypto

    7.4 HIGH 0.3% exploit odds No fix listed
  12. CVE-2026-17380

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access sensitive information belonging to other tenants due to improper validation of a path parameter. A path value in a request is not sufficiently validated, which could allow a user to reach data outside their own tenant.

    Disclosure

    8.5 HIGH 0.5% exploit odds No fix listed
  13. CVE-2026-17381

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization validation using user-controlled keys.

    Auth & access

    8.5 HIGH 0.4% exploit odds No fix listed
  14. CVE-2026-17371

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    5.0 MEDIUM 0.3% exploit odds No fix listed
  15. CVE-2026-17372

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to probe internal network resources due to insufficient validation of webhook destination URLs. User-configured webhook addresses are not sufficiently restricted, so the server could be made to contact internal systems.

    Disclosure Server

    6.4 MEDIUM 0.3% exploit odds No fix listed
  16. CVE-2026-17373

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.

    Auth & access Server

    7.7 HIGH 0.4% exploit odds No fix listed
  17. CVE-2026-17374

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    7.7 HIGH 0.4% exploit odds No fix listed
  18. CVE-2026-17375

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization decisions rely on information supplied by the client, which could allow access to information the user should not see.

    Auth & access

    7.7 HIGH 0.4% exploit odds No fix listed
  19. CVE-2026-17376

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    7.7 HIGH 0.4% exploit odds No fix listed
  20. CVE-2026-17366

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access Server

    5.0 MEDIUM 0.3% exploit odds No fix listed
  21. CVE-2026-17367

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.

    Auth & access Server

    5.4 MEDIUM 0.3% exploit odds No fix listed
  22. CVE-2026-17368

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform network reconnaissance and obtain sensitive credentials due to server-side request forgery. The server can be made to send requests to unintended destinations and return the results.

    Disclosure Server

    6.8 MEDIUM 0.5% exploit odds No fix listed
  23. CVE-2026-17369

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link the victim's session to an account controlled by the attacker.

    Auth & access Web app

    5.4 MEDIUM 0.2% exploit odds No fix listed
  24. CVE-2026-17370

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain an access token for another user due to improper authentication. The sign-in flow does not sufficiently verify the identity of the user completing it, which could allow another user's identity to be assumed.

    Auth & access

    6.4 MEDIUM 0.4% exploit odds No fix listed
  25. CVE-2026-17359

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. A user-supplied value can influence code that the product generates, which could lead to code execution.

    Injection

    9.9 CRITICAL 0.9% exploit odds No fix listed
  26. CVE-2026-17360

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.

    Auth & access Server

    9.8 CRITICAL 0.6% exploit odds No fix listed
  27. CVE-2026-17361

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server

    7.7 HIGH 0.4% exploit odds No fix listed
  28. CVE-2026-17363

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.

    Injection Server

    7.7 HIGH 0.5% exploit odds No fix listed
  29. CVE-2026-17365

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server

    8.5 HIGH 0.4% exploit odds No fix listed
  30. CVE-2026-17354

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file writes due to path traversal.

    Disclosure Server

    9.9 CRITICAL 0.7% exploit odds No fix listed
  31. CVE-2026-17355

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from internal network resources due to server-side request forgery. Destination checks on outbound requests can be bypassed, which could allow the server to reach internal systems that should be blocked.

    Disclosure Server

    8.2 HIGH 0.4% exploit odds No fix listed
  32. CVE-2026-17356

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.

    Auth & access Server

    8.7 HIGH 0.3% exploit odds No fix listed
  33. CVE-2026-17357

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network services due to server-side request forgery.

    Disclosure Server

    7.6 HIGH 0.4% exploit odds No fix listed
  34. CVE-2026-17358

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication across tenants due to improper authentication. Authentication checks are not sufficiently isolated between tenants, which could allow a user from one tenant to be accepted by another.

    Auth & access

    8.2 HIGH 0.5% exploit odds No fix listed
  35. CVE-2026-17343

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authorization checks to access or modify sensitive information due to improper authorization.

    Auth & access Server

    8.1 HIGH 0.5% exploit odds No fix listed
  36. CVE-2026-17344

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. A service that can be reached without authentication could be made to send requests to unintended destinations.

    Disclosure Server

    9.3 CRITICAL 0.5% exploit odds No fix listed
  37. CVE-2026-17345

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.

    Injection Server

    7.7 HIGH 0.5% exploit odds No fix listed
  38. CVE-2026-17352

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    Disclosure Server

    8.5 HIGH 0.4% exploit odds No fix listed
  39. CVE-2026-17353

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to server-side request forgery.

    Disclosure Server

    9.6 CRITICAL 0.5% exploit odds No fix listed
  40. CVE-2026-17338

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.

    Auth & access

    9.1 CRITICAL 0.4% exploit odds No fix listed
  41. CVE-2026-17339

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access or delete resources belonging to other tenants due to path traversal.

    Disclosure Server

    9.1 CRITICAL 0.5% exploit odds No fix listed
  42. CVE-2026-17340

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to a path traversal vulnerability.

    Disclosure

    9.8 CRITICAL 0.9% exploit odds No fix listed
  43. CVE-2026-17341

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform server-side request forgery and relay unauthorized email messages due to improper neutralization of user-supplied input.

    Disclosure Server

    7.2 HIGH 0.3% exploit odds No fix listed
  44. CVE-2026-17342

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.

    Injection

    9.9 CRITICAL 0.9% exploit odds No fix listed
  45. CVE-2026-17333

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and inject unauthorized configuration changes due to improper certificate validation.

    Crypto Server

    8.0 HIGH 0.2% exploit odds No fix listed
  46. CVE-2026-17334

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization via user-controlled keys.

    Auth & access

    8.5 HIGH 0.4% exploit odds No fix listed
  47. CVE-2026-17335

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to path traversal. File paths in uploaded content are not sufficiently validated, which could allow files to be written outside the intended location and code to be executed.

    Disclosure

    8.8 HIGH 0.8% exploit odds No fix listed
  48. CVE-2026-17336

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

    Injection Server

    9.9 CRITICAL 0.6% exploit odds No fix listed
  49. CVE-2026-17337

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication due to improper certificate validation. A certificate check is not performed reliably in all cases, which could allow a connection to be accepted without proper authentication.

    Crypto Server

    7.4 HIGH 0.2% exploit odds No fix listed
  50. CVE-2026-17328

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. Input checks are incomplete, which could allow them to be bypassed.

    Disclosure

    8.5 HIGH 0.4% exploit odds No fix listed

The newest published CVE records from CVE.org and NVD, refreshed every few minutes, with severity, exploit odds and fix status.