Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
331,420 results · page 13 of 6629
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to brokCVE-2026-17371 · Other software · IBM · reported by psirt@us.ibm.comMedium 5
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain an access token for another user CVE-2026-17370 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.4
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain an access token for another user due to improper authentication. The sign-in flow does not sufficiently verify the identity of the user completing it, which could allow another user's identity to be assumed.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controllCVE-2026-17369 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link the victim's session to an account controlled by the attacker.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform network reconnaissance and obtaiCVE-2026-17368 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.8
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform network reconnaissance and obtain sensitive credentials due to server-side request forgery. The server can be made to send requests to unintended destinations and return the results.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to insuCVE-2026-17367 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to brokCVE-2026-17366 · Other software · IBM · reported by psirt@us.ibm.comMedium 5
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to servCVE-2026-17365 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL CVE-2026-17363 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.7
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.CVE-2026-17361 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.7
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.CVE-2026-17360 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper cCVE-2026-17359 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.9
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. A user-supplied value can influence code that the product generates, which could lead to code execution.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication across tenants dueCVE-2026-17358 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.2
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication across tenants due to improper authentication. Authentication checks are not sufficiently isolated between tenants, which could allow a user from one tenant to be accepted by another.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network services due to CVE-2026-17357 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.6
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network services due to server-side request forgery.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.CVE-2026-17356 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.7
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from internal network resources due to serCVE-2026-17355 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.2
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from internal network resources due to server-side request forgery. Destination checks on outbound requests can be bypassed, which could allow the server to reach internal systems that should be blocked.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file writes due to path traversal.CVE-2026-17354 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.9
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file writes due to path traversal.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to seCVE-2026-17353 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.6
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to server-side request forgery.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.CVE-2026-17352 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to imprCVE-2026-17345 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.7
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery.CVE-2026-17344 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.3
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. A service that can be reached without authentication could be made to send requests to unintended destinations.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authorization checks to access or modify sensitive information dCVE-2026-17343 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authorization checks to access or modify sensitive information due to improper authorization.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper cCVE-2026-17342 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.9
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform server-side request forgery and relay unauthorized email messages due to imprCVE-2026-17341 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.2
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform server-side request forgery and relay unauthorized email messages due to improper neutralization of user-supplied input.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to a path traversal vulnerability.CVE-2026-17340 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to a path traversal vulnerability.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access or delete resources belonging to other tenants due to path traveCVE-2026-17339 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.1
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access or delete resources belonging to other tenants due to path traversal.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.CVE-2026-17338 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.1
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication due to improper certificate validation.CVE-2026-17337 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.4
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication due to improper certificate validation. A certificate check is not performed reliably in all cases, which could allow a connection to be accepted without proper authentication.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of speciaCVE-2026-17336 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.9
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to path traversal.CVE-2026-17335 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to path traversal. File paths in uploaded content are not sufficiently validated, which could allow files to be written outside the intended location and code to be executed.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization via user-conCVE-2026-17334 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization via user-controlled keys.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and inject unauthorized configurCVE-2026-17333 · Other software · IBM · reported by psirt@us.ibm.comHigh 8
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and inject unauthorized configuration changes due to improper certificate validation.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to improper certificate validation.CVE-2026-17332 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.7
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to improper certificate validation.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to read arbitrary files on the server due to external control of a file name or path.CVE-2026-17331 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to read arbitrary files on the server due to external control of a file name or path.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.CVE-2026-17330 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to improper validation of endpoint URLs.CVE-2026-17329 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.3
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to improper validation of endpoint URLs.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.CVE-2026-17328 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. Input checks are incomplete, which could allow them to be bypassed.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.CVE-2026-17327 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to imprCVE-2026-17326 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplieCVE-2026-17325 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access sensitive configuration data and perform unauthorized actions due to missing aCVE-2026-17324 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.3
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access sensitive configuration data and perform unauthorized actions due to missing authentication for a critical function.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to XML external entity (XXE) injection.CVE-2026-17323 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.2
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to XML external entity (XXE) injection.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive credentials and compromise accounts duCVE-2026-17322 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.1
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive credentials and compromise accounts due to insertion of sensitive information into log files.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to delete or overwrite arbitrary control-plane assets due to an insecure dCVE-2026-17321 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to delete or overwrite arbitrary control-plane assets due to an insecure direct object reference.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to an insecure direct object referenceCVE-2026-17320 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.7
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to an insecure direct object reference.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify tool configuration and cause a denial of service due to improperCVE-2026-17319 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.1
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify tool configuration and cause a denial of service due to improper authorization. Information supplied by the client is relied on when deciding what a user is allowed to do, which could allow unauthorized changes that disrupt service.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to imprCVE-2026-17318 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.7
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal resources and cause a denial of service due to server-sCVE-2026-17317 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.4
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal resources and cause a denial of service due to server-side request forgery.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform server-side request forgery due to improper validation of user-supplied inputCVE-2026-17316 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.2
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform server-side request forgery due to improper validation of user-supplied input.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to improper validation of user-supplied URLs.CVE-2026-17315 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.8
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to improper validation of user-supplied URLs.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.CVE-2026-17314 · Other software · IBM · reported by psirt@us.ibm.comMedium 5
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.