Security alerts

2,031 alerts · page 11 of 102

1. Critical (CVSS 9+) Published 2026-11-07 06:32

   CVE-2026-17296 Multiple Vulnerabilities in IBM API Connect

   Critical·CVSS 9.6

   Exploit status: No public exploit known

   Affects: ibm api connect

   IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

2. Critical (CVSS 9+) Published 2026-11-07 06:32 · updated 2026-11-09 15:38

   CVE-2026-17292 Multiple Vulnerabilities in IBM API Connect

   Critical·CVSS 9.1

   Exploit status: No public exploit known

   Affects: ibm api connect

   IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to take over ownership of other organizations due to broken object-level authorization. Access checks on organization objects are incomplete, which could allow own...

3. Critical (CVSS 9+) Published 2026-11-07 06:32

   CVE-2026-17278 Multiple Vulnerabilities in IBM API Connect

   Critical·CVSS 9.8

   Exploit status: No public exploit known

   Affects: ibm api connect

   IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain unauthorized access to sensitive API catalog and runtime configuration data due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller...

4. Critical (CVSS 9+) Published 2026-11-07 06:32 · updated 2026-11-09 17:12

   CVE-2026-17239 Multiple Vulnerabilities in IBM API Connect

   Critical·CVSS 9.9

   Exploit status: No public exploit known

   Affects: ibm api connect

   IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a path traversal vulnerability.

5. Critical (CVSS 9+) Published 2026-11-07 06:32 · updated 2026-11-10 06:56

   CVE-2026-17158 Multiple Vulnerabilities in IBM API Connect

   Critical·CVSS 9.9

   Exploit status: No public exploit known

   Affects: ibm api connect

   IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain elevated privileges due to improper authentication.

6. Critical (CVSS 9+) Published 2026-11-07 06:32 · updated 2026-11-09 06:55

   CVE-2026-17150 Multiple Vulnerabilities in IBM API Connect

   Critical·CVSS 9.9

   Exploit status: No public exploit known

   Affects: ibm api connect

   IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants due to insufficient input validation. Uploaded custom module content is not sufficien...

7. Critical (CVSS 9+) Published 2026-11-07 06:32 · updated 2026-11-09 06:55

   CVE-2026-17147 Multiple Vulnerabilities in IBM API Connect

   Critical·CVSS 9.9

   Exploit status: No public exploit known

   Affects: ibm api connect

   IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and perform unauthorized administrative actions due to a path traversal vulnerability.

8. Critical (CVSS 9+) Published 2026-11-07 06:32

   CVE-2026-17146 Multiple Vulnerabilities in IBM API Connect

   Critical·CVSS 9.9

   Exploit status: No public exploit known

   Affects: ibm api connect

   IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information due to improper input validation.

9. Critical (CVSS 9+) Published 2026-11-07 06:31 · updated 2026-11-10 21:05

   CVE-2026-17134 Multiple Vulnerabilities in IBM API Connect

   Critical·CVSS 9.9

   Exploit status: No public exploit known

   Affects: ibm api connect

   IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection.

10. Critical (CVSS 9+) Published 2026-11-07 06:31 · updated 2026-11-10 21:13

    CVE-2026-17132 Multiple Vulnerabilities in IBM API Connect

    Critical·CVSS 9.9

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

11. Critical (CVSS 9+) Published 2026-11-07 06:31

    CVE-2026-17131 Multiple Vulnerabilities in IBM API Connect

    Critical·CVSS 9.3

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to contact unintended destinations and return the response.

12. Critical (CVSS 9+) Published 2026-11-07 06:31 · updated 2026-11-09 17:12

    CVE-2026-17117 Multiple Vulnerabilities in IBM API Connect

    Critical·CVSS 9.9

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improperly controlled modification of object attributes. A user could set a field that should only be controlled by the system, wh...

13. Critical (CVSS 9+) Published 2026-11-07 06:31 · updated 2026-11-10 20:53

    CVE-2026-17066 Multiple Vulnerabilities in IBM API Connect

    Critical·CVSS 9.1

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify or delete data belonging to other tenants due to missing authorization.

14. Critical (CVSS 9+) Published 2026-11-07 06:31 · updated 2026-11-10 20:54

    CVE-2026-17049 Multiple Vulnerabilities in IBM API Connect

    Critical·CVSS 9.9

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify arbitrary documents due to authorization bypass through user-controlled keys.

15. Critical (CVSS 9+) Published 2026-11-07 06:31 · updated 2026-11-10 21:20

    CVE-2026-16920 Multiple Vulnerabilities in IBM API Connect

    Critical·CVSS 9.9

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to a confused deputy vulnerability.

16. Critical (CVSS 9+) Published 2026-11-07 06:31

    CVE-2026-16918 Multiple Vulnerabilities in IBM API Connect

    Critical·CVSS 9.3

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources due to server-side request forgery.

17. Critical (CVSS 9+) Published 2026-11-07 06:31

    CVE-2026-16884 Multiple Vulnerabilities in IBM API Connect

    Critical·CVSS 9.9

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection.

18. Critical (CVSS 9+) Published 2026-11-07 06:31

    CVE-2026-16720 Multiple Vulnerabilities in IBM API Connect

    Critical·CVSS 9.8

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain valid access tokens for other users due to improper authentication. Authentication against a connected directory service is not sufficiently enforced, which could allo...

19. CISA KEV addition Critical (CVSS 9+) Published 2026-11-07 05:47 · updated 2026-11-10 06:56

    CVE-2026-123218 IBM Aspera Faspex Authorization Bypass

    Critical·CVSS 9.8 EPSS 0.71% CISA KEV added 2026-11-09 · due 2026-11-12 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: ibm Aspera Faspex

    IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.

20. Critical (CVSS 9+) Published 2026-11-07 05:28 · updated 2026-11-08 21:05

    CVE-2026-19803 Printcart Store <= 2.13.2 - Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' Parameter

    Critical·CVSS 9.8

    Exploit status: No public exploit known

    Affects: Printcart Store – Web to Print Product Designer for WooCommerce

    The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.13.2. This is due to the nbu_crop_image AJAX handler accepting a user-supplied url parameter that Nbdesigner_IO:...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).