Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
331,678 results · page 20 of 6634
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an observable respCVE-2026-17231 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.8
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an observable response discrepancy.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to a paCVE-2026-17230 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.CVE-2026-17228 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Destination restrictions on outbound requests can be bypassed, which could allow the server to retrieve content from unintended resources.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions and access CVE-2026-17225 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions and access unauthorized analytics queries due to improper input validation. Request parameters are not validated sufficiently, which could allow restrictions on analytics data to be circumvented.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to verbCVE-2026-17215 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to verbose error messages. Error responses contain more information about the system than necessary, which could help an attacker learn about the environment.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to LDAP injection.CVE-2026-17214 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.8
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to LDAP injection.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to cause a denial of service due to incorreCVE-2026-17211 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to cause a denial of service due to incorrect type conversion. A value is converted incorrectly between two different types, which could cause the service to return invalid responses or become unavailable.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to enumerate usernames due to observable differences in response behavior.CVE-2026-17202 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to enumerate usernames due to observable differences in response behavior.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript due to crosCVE-2026-17190 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.7
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript due to cross-site scripting. HTML content supplied by a provider is not sufficiently sanitized before it is displayed, which could allow script content to run in the user's browser.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.CVE-2026-17188 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. When service definitions are imported, references to external resources are not sufficiently restricted, so the server could be made to request resources it should not access.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplieCVE-2026-17187 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to imprCVE-2026-17172 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to impersonate another party.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to falsify audit log information due to reliance on untrusted inputs.CVE-2026-17167 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to falsify audit log information due to reliance on untrusted inputs. Information supplied by the client is relied on when recording the source of a request, so audit records could contain inaccurate details.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain elevated privileges due to improperCVE-2026-17158 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.9
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain elevated privileges due to improper authentication.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of user-controCVE-2026-17155 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of user-controlled input.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform cross-site scripting due to improper neutralization of user-supCVE-2026-17154 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform cross-site scripting due to improper neutralization of user-supplied input.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and access sensitCVE-2026-17150 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.9
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants due to insufficient input validation. Uploaded custom module content is not sufficiently validated before it is processed, which could allow code to run with access beyond the user's own tenant.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and perform unautCVE-2026-17147 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.9
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and perform unauthorized administrative actions due to a path traversal vulnerability.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript and obtain CVE-2026-17146 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.9
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information due to improper input validation.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to imprCVE-2026-17144 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform HTML injection due to improper nCVE-2026-17143 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform HTML injection due to improper neutralization of user-supplied input.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper cCVE-2026-17140 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. Input supplied by a user can influence code generated by the product, which could lead to code execution.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-sCVE-2026-17139 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. Certain URL fields are not sufficiently validated, so malicious script content could run in another user's browser session.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to improper use of cryptography.CVE-2026-17137 · Other software · IBM · reported by psirt@us.ibm.comMedium 4
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to improper use of cryptography. The encryption applied to stored data is not implemented with sufficient strength, which weakens its protection.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection.CVE-2026-17134 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.9
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of speciaCVE-2026-17132 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.9
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery.CVE-2026-17131 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.3
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to contact unintended destinations and return the response.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an inCVE-2026-17129 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.6
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an insecure direct object reference.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to the insertion of sensitive informatCVE-2026-17128 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.8
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to the insertion of sensitive information into log files.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improperlyCVE-2026-17117 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.9
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improperly controlled modification of object attributes. A user could set a field that should only be controlled by the system, which could lead to code execution.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause aCVE-2026-17114 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to the generation of error messages containing sensitive information.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information belonging tCVE-2026-17112 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.7
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information belonging to other tenants due to broken object-level authorization.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.CVE-2026-17108 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to verbose error messCVE-2026-17098 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to verbose error messages.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to imprCVE-2026-17085 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.1
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper handling of case sensitivity. An access restriction is not applied consistently to all variations of the input, which could allow it to be circumvented and unauthorized emails to be sent.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due toCVE-2026-17067 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to server-side request forgery.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify or delete data belonging to othCVE-2026-17066 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.1
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify or delete data belonging to other tenants due to missing authorization.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to an iCVE-2026-17064 · Other software · IBM · reported by psirt@us.ibm.comMedium 5
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to an insecure direct object reference.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify internal requests due to improperCVE-2026-17062 · Other software · IBM · reported by psirt@us.ibm.comLow 2.7
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify internal requests due to improper neutralization of argument delimiters. Special characters in user-supplied input are not handled safely, which could allow additional parameters to be added to a request made by the server.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify arbitrary documents due to authCVE-2026-17049 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.9
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify arbitrary documents due to authorization bypass through user-controlled keys.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to a confused deputy vulnerability.CVE-2026-16920 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.9
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to a confused deputy vulnerability.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources due to server-side rCVE-2026-16918 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.3
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources due to server-side request forgery.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to servCVE-2026-16912 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection.CVE-2026-16884 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.9
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to pathCVE-2026-16880 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.5
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information belonging to other tenants due to an injecCVE-2026-16854 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.7
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information belonging to other tenants due to an injection vulnerability. Input used to build a data query is not properly neutralized, which could allow the query to return data the user is not permitted to see.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain valid access tokens for other users due to imprCVE-2026-16720 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain valid access tokens for other users due to improper authentication. Authentication against a connected directory service is not sufficiently enforced, which could allow another user's identity to be assumed.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to view arbitrary files on the system due to a path traveCVE-2026-16719 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to view arbitrary files on the system due to a path traversal vulnerability. A specially crafted URL request could allow directories outside the intended location to be accessed.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to imprCVE-2026-16718 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.7
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2026IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.CVE-2026-16717 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.7
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
- Product
- API Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.