CVE-2026-17331
Nov 7, 2026 UTC
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to read arbitrary files on the server due to external control of a file name or path.
Inspect record →CVSS7.5high
Vulnerability intelligence / live index
Recently updated CVEs
A working index of published vulnerability records, ordered by latest update. Open a record to inspect its score, vector, and impact metrics.
Data source
CVE Program / CVE List®
Updated continuously
CVE-2026-17330
Nov 7, 2026 UTC
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
Inspect record →CVSS8.5high
CVE-2026-17329
Nov 7, 2026 UTC
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to improper validation of endpoint URLs.
Inspect record →CVSS9.3critical
CVE-2026-17328
Nov 7, 2026 UTC
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. Input checks are incomplete, which could allow them to be bypassed.
Inspect record →CVSS8.5high
CVE-2026-17327
Nov 7, 2026 UTC
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
Inspect record →CVSS8.5high
CVE-2026-17326
Nov 7, 2026 UTC
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
Inspect record →CVSS8.1high
CVE-2026-17325
Nov 7, 2026 UTC
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.
Inspect record →CVSS8.5high
CVE-2026-17324
Nov 7, 2026 UTC
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access sensitive configuration data and perform unauthorized actions due to missing authentication for a critical function.
Inspect record →CVSS8.3high
CVE-2026-17323
Nov 7, 2026 UTC
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to XML external entity (XXE) injection.
Inspect record →CVSS8.2high
CVE-2026-17322
Nov 7, 2026 UTC
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive credentials and compromise accounts due to insertion of sensitive information into log files.
Inspect record →CVSS7.1high
CVE-2026-17321
Nov 7, 2026 UTC
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to delete or overwrite arbitrary control-plane assets due to an insecure direct object reference.
Inspect record →CVSS8.1high
CVE-2026-17320
Nov 7, 2026 UTC
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to an insecure direct object reference.
Inspect record →CVSS7.7high
CVE-2026-17319
Nov 7, 2026 UTC
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify tool configuration and cause a denial of service due to improper authorization. Information supplied by the client is relied on when deciding what a user is allowed to do, which could …
Inspect record →CVSS7.1high
CVE-2026-17318
Nov 7, 2026 UTC
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
Inspect record →CVSS7.7high
CVE-2026-17317
Nov 7, 2026 UTC
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal resources and cause a denial of service due to server-side request forgery.
Inspect record →CVSS6.4medium