https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-75590/https://vulnfeed.org/cve/CVE-2026-75590/Sat, 07 Nov 2026 05:19:01 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources and obtain sensitive information due to server-side request forgery. A protection that blocks requests to internal addresses can be bypassed, so the server could be made to contact internal services and return part of their responses.https://vulnfeed.org/cve/CVE-2026-19128/https://vulnfeed.org/cve/CVE-2026-19128/Sat, 07 Nov 2026 05:19:00 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.https://vulnfeed.org/cve/CVE-2026-18836/https://vulnfeed.org/cve/CVE-2026-18836/Sat, 07 Nov 2026 05:18:59 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.https://vulnfeed.org/cve/CVE-2026-18838/https://vulnfeed.org/cve/CVE-2026-18838/Sat, 07 Nov 2026 05:18:59 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which could allow a caller to impersonate another user.https://vulnfeed.org/cve/CVE-2026-19121/https://vulnfeed.org/cve/CVE-2026-19121/Sat, 07 Nov 2026 05:18:59 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.https://vulnfeed.org/cve/CVE-2026-17409/https://vulnfeed.org/cve/CVE-2026-17409/Sat, 07 Nov 2026 05:18:58 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.https://vulnfeed.org/cve/CVE-2026-17410/https://vulnfeed.org/cve/CVE-2026-17410/Sat, 07 Nov 2026 05:18:58 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.https://vulnfeed.org/cve/CVE-2026-17411/https://vulnfeed.org/cve/CVE-2026-17411/Sat, 07 Nov 2026 05:18:58 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.https://vulnfeed.org/cve/CVE-2026-17405/https://vulnfeed.org/cve/CVE-2026-17405/Sat, 07 Nov 2026 05:18:57 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.https://vulnfeed.org/cve/CVE-2026-17406/https://vulnfeed.org/cve/CVE-2026-17406/Sat, 07 Nov 2026 05:18:57 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.https://vulnfeed.org/cve/CVE-2026-17407/https://vulnfeed.org/cve/CVE-2026-17407/Sat, 07 Nov 2026 05:18:57 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.https://vulnfeed.org/cve/CVE-2026-17408/https://vulnfeed.org/cve/CVE-2026-17408/Sat, 07 Nov 2026 05:18:57 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.https://vulnfeed.org/cve/CVE-2026-17400/https://vulnfeed.org/cve/CVE-2026-17400/Sat, 07 Nov 2026 05:18:56 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.https://vulnfeed.org/cve/CVE-2026-17401/https://vulnfeed.org/cve/CVE-2026-17401/Sat, 07 Nov 2026 05:18:56 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.https://vulnfeed.org/cve/CVE-2026-17402/https://vulnfeed.org/cve/CVE-2026-17402/Sat, 07 Nov 2026 05:18:56 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.https://vulnfeed.org/cve/CVE-2026-17403/https://vulnfeed.org/cve/CVE-2026-17403/Sat, 07 Nov 2026 05:18:56 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.https://vulnfeed.org/cve/CVE-2026-17404/https://vulnfeed.org/cve/CVE-2026-17404/Sat, 07 Nov 2026 05:18:56 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.https://vulnfeed.org/cve/CVE-2026-17396/https://vulnfeed.org/cve/CVE-2026-17396/Sat, 07 Nov 2026 05:18:55 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.https://vulnfeed.org/cve/CVE-2026-17397/https://vulnfeed.org/cve/CVE-2026-17397/Sat, 07 Nov 2026 05:18:55 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.https://vulnfeed.org/cve/CVE-2026-17398/https://vulnfeed.org/cve/CVE-2026-17398/Sat, 07 Nov 2026 05:18:55 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.https://vulnfeed.org/cve/CVE-2026-17399/https://vulnfeed.org/cve/CVE-2026-17399/Sat, 07 Nov 2026 05:18:55 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server.https://vulnfeed.org/cve/CVE-2026-17392/https://vulnfeed.org/cve/CVE-2026-17392/Sat, 07 Nov 2026 05:18:54 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant.https://vulnfeed.org/cve/CVE-2026-17394/https://vulnfeed.org/cve/CVE-2026-17394/Sat, 07 Nov 2026 05:18:54 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should be controlled by the system, which could expose sensitive information.https://vulnfeed.org/cve/CVE-2026-17387/https://vulnfeed.org/cve/CVE-2026-17387/Sat, 07 Nov 2026 05:18:53 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.https://vulnfeed.org/cve/CVE-2026-17388/https://vulnfeed.org/cve/CVE-2026-17388/Sat, 07 Nov 2026 05:18:53 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.https://vulnfeed.org/cve/CVE-2026-17382/https://vulnfeed.org/cve/CVE-2026-17382/Sat, 07 Nov 2026 05:18:52 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.https://vulnfeed.org/cve/CVE-2026-17383/https://vulnfeed.org/cve/CVE-2026-17383/Sat, 07 Nov 2026 05:18:52 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.https://vulnfeed.org/cve/CVE-2026-17385/https://vulnfeed.org/cve/CVE-2026-17385/Sat, 07 Nov 2026 05:18:52 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.https://vulnfeed.org/cve/CVE-2026-17378/https://vulnfeed.org/cve/CVE-2026-17378/Sat, 07 Nov 2026 05:18:51 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.https://vulnfeed.org/cve/CVE-2026-17379/https://vulnfeed.org/cve/CVE-2026-17379/Sat, 07 Nov 2026 05:18:51 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and assign arbitrary roles due to improper verification of cryptographic signatures.https://vulnfeed.org/cve/CVE-2026-17380/https://vulnfeed.org/cve/CVE-2026-17380/Sat, 07 Nov 2026 05:18:51 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access sensitive information belonging to other tenants due to improper validation of a path parameter. A path value in a request is not sufficiently validated, which could allow a user to reach data outside their own tenant.https://vulnfeed.org/cve/CVE-2026-17381/https://vulnfeed.org/cve/CVE-2026-17381/Sat, 07 Nov 2026 05:18:51 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization validation using user-controlled keys.https://vulnfeed.org/cve/CVE-2026-17373/https://vulnfeed.org/cve/CVE-2026-17373/Sat, 07 Nov 2026 05:18:50 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.https://vulnfeed.org/cve/CVE-2026-17374/https://vulnfeed.org/cve/CVE-2026-17374/Sat, 07 Nov 2026 05:18:50 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.https://vulnfeed.org/cve/CVE-2026-17375/https://vulnfeed.org/cve/CVE-2026-17375/Sat, 07 Nov 2026 05:18:50 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization decisions rely on information supplied by the client, which could allow access to information the user should not see.https://vulnfeed.org/cve/CVE-2026-17376/https://vulnfeed.org/cve/CVE-2026-17376/Sat, 07 Nov 2026 05:18:50 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.https://vulnfeed.org/cve/CVE-2026-17359/https://vulnfeed.org/cve/CVE-2026-17359/Sat, 07 Nov 2026 05:18:48 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. A user-supplied value can influence code that the product generates, which could lead to code execution.https://vulnfeed.org/cve/CVE-2026-17360/https://vulnfeed.org/cve/CVE-2026-17360/Sat, 07 Nov 2026 05:18:48 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.https://vulnfeed.org/cve/CVE-2026-17361/https://vulnfeed.org/cve/CVE-2026-17361/Sat, 07 Nov 2026 05:18:48 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.https://vulnfeed.org/cve/CVE-2026-17363/https://vulnfeed.org/cve/CVE-2026-17363/Sat, 07 Nov 2026 05:18:48 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.https://vulnfeed.org/cve/CVE-2026-17365/https://vulnfeed.org/cve/CVE-2026-17365/Sat, 07 Nov 2026 05:18:48 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.https://vulnfeed.org/cve/CVE-2026-17354/https://vulnfeed.org/cve/CVE-2026-17354/Sat, 07 Nov 2026 05:18:47 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file writes due to path traversal.https://vulnfeed.org/cve/CVE-2026-17355/https://vulnfeed.org/cve/CVE-2026-17355/Sat, 07 Nov 2026 05:18:47 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from internal network resources due to server-side request forgery. Destination checks on outbound requests can be bypassed, which could allow the server to reach internal systems that should be blocked.https://vulnfeed.org/cve/CVE-2026-17356/https://vulnfeed.org/cve/CVE-2026-17356/Sat, 07 Nov 2026 05:18:47 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.https://vulnfeed.org/cve/CVE-2026-17357/https://vulnfeed.org/cve/CVE-2026-17357/Sat, 07 Nov 2026 05:18:47 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network services due to server-side request forgery.https://vulnfeed.org/cve/CVE-2026-17358/https://vulnfeed.org/cve/CVE-2026-17358/Sat, 07 Nov 2026 05:18:47 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication across tenants due to improper authentication. Authentication checks are not sufficiently isolated between tenants, which could allow a user from one tenant to be accepted by another.https://vulnfeed.org/cve/CVE-2026-17343/https://vulnfeed.org/cve/CVE-2026-17343/Sat, 07 Nov 2026 05:18:46 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authorization checks to access or modify sensitive information due to improper authorization.https://vulnfeed.org/cve/CVE-2026-17344/https://vulnfeed.org/cve/CVE-2026-17344/Sat, 07 Nov 2026 05:18:46 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. A service that can be reached without authentication could be made to send requests to unintended destinations.https://vulnfeed.org/cve/CVE-2026-17345/https://vulnfeed.org/cve/CVE-2026-17345/Sat, 07 Nov 2026 05:18:46 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.https://vulnfeed.org/cve/CVE-2026-17352/https://vulnfeed.org/cve/CVE-2026-17352/Sat, 07 Nov 2026 05:18:46 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.https://vulnfeed.org/cve/CVE-2026-17353/https://vulnfeed.org/cve/CVE-2026-17353/Sat, 07 Nov 2026 05:18:46 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to server-side request forgery.https://vulnfeed.org/cve/CVE-2026-17338/https://vulnfeed.org/cve/CVE-2026-17338/Sat, 07 Nov 2026 05:18:45 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.https://vulnfeed.org/cve/CVE-2026-17339/https://vulnfeed.org/cve/CVE-2026-17339/Sat, 07 Nov 2026 05:18:45 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access or delete resources belonging to other tenants due to path traversal.https://vulnfeed.org/cve/CVE-2026-17340/https://vulnfeed.org/cve/CVE-2026-17340/Sat, 07 Nov 2026 05:18:45 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to a path traversal vulnerability.https://vulnfeed.org/cve/CVE-2026-17341/https://vulnfeed.org/cve/CVE-2026-17341/Sat, 07 Nov 2026 05:18:45 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform server-side request forgery and relay unauthorized email messages due to improper neutralization of user-supplied input.https://vulnfeed.org/cve/CVE-2026-17342/https://vulnfeed.org/cve/CVE-2026-17342/Sat, 07 Nov 2026 05:18:45 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.https://vulnfeed.org/cve/CVE-2026-17333/https://vulnfeed.org/cve/CVE-2026-17333/Sat, 07 Nov 2026 05:18:44 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and inject unauthorized configuration changes due to improper certificate validation.https://vulnfeed.org/cve/CVE-2026-17334/https://vulnfeed.org/cve/CVE-2026-17334/Sat, 07 Nov 2026 05:18:44 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization via user-controlled keys.https://vulnfeed.org/cve/CVE-2026-17335/https://vulnfeed.org/cve/CVE-2026-17335/Sat, 07 Nov 2026 05:18:44 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to path traversal. File paths in uploaded content are not sufficiently validated, which could allow files to be written outside the intended location and code to be executed.https://vulnfeed.org/cve/CVE-2026-17336/https://vulnfeed.org/cve/CVE-2026-17336/Sat, 07 Nov 2026 05:18:44 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.https://vulnfeed.org/cve/CVE-2026-17337/https://vulnfeed.org/cve/CVE-2026-17337/Sat, 07 Nov 2026 05:18:44 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication due to improper certificate validation. A certificate check is not performed reliably in all cases, which could allow a connection to be accepted without proper authentication.https://vulnfeed.org/cve/CVE-2026-17330/https://vulnfeed.org/cve/CVE-2026-17330/Sat, 07 Nov 2026 05:18:43 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.https://vulnfeed.org/cve/CVE-2026-17331/https://vulnfeed.org/cve/CVE-2026-17331/Sat, 07 Nov 2026 05:18:43 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to read arbitrary files on the server due to external control of a file name or path.https://vulnfeed.org/cve/CVE-2026-17332/https://vulnfeed.org/cve/CVE-2026-17332/Sat, 07 Nov 2026 05:18:43 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to improper certificate validation.https://vulnfeed.org/cve/CVE-2026-18535/https://vulnfeed.org/cve/CVE-2026-18535/Sat, 07 Nov 2026 04:56:45 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.https://vulnfeed.org/cve/CVE-2026-17386/https://vulnfeed.org/cve/CVE-2026-17386/Sat, 07 Nov 2026 04:41:02 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote attacker to gain full administrative control due to the use of a cryptographically weak pseudo-random number generator.https://vulnfeed.org/cve/CVE-2026-17384/https://vulnfeed.org/cve/CVE-2026-17384/Sat, 07 Nov 2026 04:40:55 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.https://vulnfeed.org/cve/CVE-2026-17329/https://vulnfeed.org/cve/CVE-2026-17329/Sat, 07 Nov 2026 04:33:21 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to improper validation of endpoint URLs.https://vulnfeed.org/cve/CVE-2026-17328/https://vulnfeed.org/cve/CVE-2026-17328/Sat, 07 Nov 2026 04:33:20 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. Input checks are incomplete, which could allow them to be bypassed.https://vulnfeed.org/cve/CVE-2026-17327/https://vulnfeed.org/cve/CVE-2026-17327/Sat, 07 Nov 2026 04:33:19 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.https://vulnfeed.org/cve/CVE-2026-17326/https://vulnfeed.org/cve/CVE-2026-17326/Sat, 07 Nov 2026 04:33:18 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.https://vulnfeed.org/cve/CVE-2026-17325/https://vulnfeed.org/cve/CVE-2026-17325/Sat, 07 Nov 2026 04:33:17 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.https://vulnfeed.org/cve/CVE-2026-17324/https://vulnfeed.org/cve/CVE-2026-17324/Sat, 07 Nov 2026 04:33:16 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access sensitive configuration data and perform unauthorized actions due to missing authentication for a critical function.https://vulnfeed.org/cve/CVE-2026-17323/https://vulnfeed.org/cve/CVE-2026-17323/Sat, 07 Nov 2026 04:33:15 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to XML external entity (XXE) injection.https://vulnfeed.org/cve/CVE-2026-17322/https://vulnfeed.org/cve/CVE-2026-17322/Sat, 07 Nov 2026 04:33:14 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive credentials and compromise accounts due to insertion of sensitive information into log files.https://vulnfeed.org/cve/CVE-2026-17321/https://vulnfeed.org/cve/CVE-2026-17321/Sat, 07 Nov 2026 04:33:13 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to delete or overwrite arbitrary control-plane assets due to an insecure direct object reference.https://vulnfeed.org/cve/CVE-2026-17320/https://vulnfeed.org/cve/CVE-2026-17320/Sat, 07 Nov 2026 04:33:12 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to an insecure direct object reference.https://vulnfeed.org/cve/CVE-2026-17319/https://vulnfeed.org/cve/CVE-2026-17319/Sat, 07 Nov 2026 04:33:11 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify tool configuration and cause a denial of service due to improper authorization. Information supplied by the client is relied on when deciding what a user is allowed to do, which could allow unauthorized changes that disrupt service.https://vulnfeed.org/cve/CVE-2026-17318/https://vulnfeed.org/cve/CVE-2026-17318/Sat, 07 Nov 2026 04:33:10 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.https://vulnfeed.org/cve/CVE-2026-17316/https://vulnfeed.org/cve/CVE-2026-17316/Sat, 07 Nov 2026 04:33:08 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform server-side request forgery due to improper validation of user-supplied input.https://vulnfeed.org/cve/CVE-2026-17313/https://vulnfeed.org/cve/CVE-2026-17313/Sat, 07 Nov 2026 04:33:05 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and take control of gateway configuration due to authentication bypass via an alternate path.https://vulnfeed.org/cve/CVE-2026-17311/https://vulnfeed.org/cve/CVE-2026-17311/Sat, 07 Nov 2026 04:33:03 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify application API subscriptions due to broken object-level authorization.https://vulnfeed.org/cve/CVE-2026-17309/https://vulnfeed.org/cve/CVE-2026-17309/Sat, 07 Nov 2026 04:33:01 +0000IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and tamper with configuration due to improper certificate validation.https://vulnfeed.org/cve/CVE-2026-17301/https://vulnfeed.org/cve/CVE-2026-17301/Sat, 07 Nov 2026 04:32:52 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an unauthenticated attacker to bypass authentication due to improper verification of a cryptographic signature.https://vulnfeed.org/cve/CVE-2026-17299/https://vulnfeed.org/cve/CVE-2026-17299/Sat, 07 Nov 2026 04:32:51 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file reads and server-side request forgery due to unrestricted resolution of external references. Externally referenced content in submitted definitions is not sufficiently restricted when processed, and the retrieved content could be returned to the attacker.https://vulnfeed.org/cve/CVE-2026-17298/https://vulnfeed.org/cve/CVE-2026-17298/Sat, 07 Nov 2026 04:32:50 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.https://vulnfeed.org/cve/CVE-2026-17297/https://vulnfeed.org/cve/CVE-2026-17297/Sat, 07 Nov 2026 04:32:49 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform an account takeover due to an open redirect vulnerability. The redirect address used during sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.https://vulnfeed.org/cve/CVE-2026-17296/https://vulnfeed.org/cve/CVE-2026-17296/Sat, 07 Nov 2026 04:32:48 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.https://vulnfeed.org/cve/CVE-2026-17295/https://vulnfeed.org/cve/CVE-2026-17295/Sat, 07 Nov 2026 04:32:47 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.https://vulnfeed.org/cve/CVE-2026-17294/https://vulnfeed.org/cve/CVE-2026-17294/Sat, 07 Nov 2026 04:32:46 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.https://vulnfeed.org/cve/CVE-2026-17293/https://vulnfeed.org/cve/CVE-2026-17293/Sat, 07 Nov 2026 04:32:45 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify user profile information due to broken object-level authorization. Access checks do not confirm that the user is permitted to change the targeted profile.https://vulnfeed.org/cve/CVE-2026-17292/https://vulnfeed.org/cve/CVE-2026-17292/Sat, 07 Nov 2026 04:32:44 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to take over ownership of other organizations due to broken object-level authorization. Access checks on organization objects are incomplete, which could allow ownership of organizations the user does not control to be changed.https://vulnfeed.org/cve/CVE-2026-17291/https://vulnfeed.org/cve/CVE-2026-17291/Sat, 07 Nov 2026 04:32:43 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform account takeover due to an open redirect vulnerability. The redirect address used during OAuth 2.0 sign-in is not sufficiently validated, which could allow authentication results to be sent to an attacker-controlled location.https://vulnfeed.org/cve/CVE-2026-17290/https://vulnfeed.org/cve/CVE-2026-17290/Sat, 07 Nov 2026 04:32:42 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to create unauthorized user accounts due to improper verification of cryptographic signatures. Identity information from a login provider is accepted without its signature being fully verified, so forged identity data could be used to create accounts.https://vulnfeed.org/cve/CVE-2026-17289/https://vulnfeed.org/cve/CVE-2026-17289/Sat, 07 Nov 2026 04:32:40 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.https://vulnfeed.org/cve/CVE-2026-17288/https://vulnfeed.org/cve/CVE-2026-17288/Sat, 07 Nov 2026 04:32:39 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.https://vulnfeed.org/cve/CVE-2026-17287/https://vulnfeed.org/cve/CVE-2026-17287/Sat, 07 Nov 2026 04:32:38 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. User-supplied addresses are not sufficiently validated, so the server could be made to send requests to unintended destinations and return the results.https://vulnfeed.org/cve/CVE-2026-17285/https://vulnfeed.org/cve/CVE-2026-17285/Sat, 07 Nov 2026 04:32:37 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of external references. When schemas are validated, references to external resources are not sufficiently restricted, which could allow the server to retrieve content it should not access.https://vulnfeed.org/cve/CVE-2026-17284/https://vulnfeed.org/cve/CVE-2026-17284/Sat, 07 Nov 2026 04:32:36 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform unauthorized operations in other tenants' environments due to improper validation of client-supplied information. Tenant context is not sufficiently verified, which could allow actions on resources belonging to other tenants.https://vulnfeed.org/cve/CVE-2026-17283/https://vulnfeed.org/cve/CVE-2026-17283/Sat, 07 Nov 2026 04:32:35 +0000IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.