Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 785 | 0,2 % |
| ≥50 % | 3.559 | 0,9 % |
| ≥10 % | 13.142 | 3,2 % |
| <10 % | 396.069 | 95,8 % |
CVE-2023-1101 | SonicWALL SonicOS SSL VPN excessive authentication (SNWLID-2023-0005 / EUVD-2023-23388)
A vulnerability described as problematic has been identified in SonicWALL SonicOS. This issue affects some unknown processing of the component SSL VPN. Such manipulation leads to improper restriction of excessive authentication attempts. Th
CVE-2022-22278 | SonicWALL SonicOS 403 Content Filtering Service allocation of resources (SNWLID-2022-0004)
A vulnerability was found in SonicWALL SonicOS 403 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Content Filtering Service. The manipulation results in allocation of resources. Th
CVE-2022-22277 | SonicWALL SonicOS SNMP Service information disclosure (SNWLID-2022-0004)
A vulnerability was found in SonicWALL SonicOS. It has been classified as problematic. This issue affects some unknown processing of the component SNMP Service. Performing a manipulation results in information disclosure. This vulnerability
CVE-2022-22276 | SonicWALL SonicOS SNMP Service information disclosure (SNWLID-2022-0004)
A vulnerability was found in SonicWALL SonicOS and classified as problematic. This vulnerability affects unknown code of the component SNMP Service. Such manipulation leads to information disclosure. This vulnerability is listed as CVE-2022
CVE-2022-22275 | SonicWALL SonicOS TCP Communication Channel resource consumption (SNWLID-2022-0004)
A vulnerability has been found in SonicWALL SonicOS and classified as problematic. This affects an unknown part of the component TCP Communication Channel. This manipulation causes resource consumption. This vulnerability is tracked as CVE-
CVE-2022-22274 | SonicWALL SonicOS HTTP Request stack-based overflow (SNWLID-2022-0003)
A vulnerability described as critical has been identified in SonicWALL SonicOS. Impacted is an unknown function of the component HTTP Request Handler. The manipulation results in stack-based buffer overflow. This vulnerability is identified
CVE-2021-20048 | SonicWALL SonicOS 5/6/7 HTTP Response Header stack-based overflow (SNWLID-2021-0028)
A vulnerability was found in SonicWALL SonicOS 5/6/7. It has been classified as critical. The impacted element is an unknown function of the component HTTP Response Header Handler. The manipulation leads to stack-based buffer overflow. This
CVE-2021-20046 | SonicWALL SonicOS 5/6/7 HTTP Content-Length stack-based overflow (SNWLID-2021-0027)
A vulnerability was found in SonicWALL SonicOS 5/6/7 and classified as critical. The affected element is an unknown function of the component HTTP Content-Length Handler. Executing a manipulation can lead to stack-based buffer overflow. The
CVE-2021-20027 | SonicWALL SonicOS buffer overflow (SNWLID-2021-0016)
A vulnerability, which was classified as critical, was found in SonicWALL SonicOS. Affected by this issue is some unknown functionality. Executing a manipulation can lead to buffer overflow. This vulnerability is handled as CVE-2021-20027.
CVE-2026-123792 | SensioLabs Symfony up to 5.4.55/6.4.49/7.4.22/8.1.10 Inline/Parser denial of service (Nessus ID 377464)
A vulnerability classified as problematic was found in SensioLabs Symfony up to 5.4.55/6.4.49/7.4.22/8.1.10. Affected by this vulnerability is an unknown functionality of the component Inline/Parser. The manipulation results in denial of se
CVE-2026-122053 | Sensiolabs Symfony up to 8.1.10 Serializer ObjectNormalizer isAllowedAttribute privileges management (Nessus ID 377465)
A vulnerability has been found in Sensiolabs Symfony up to 5.4.55/6.4.49/7.0.x/7.4.22/8.1.10 and classified as critical. This issue affects the function ObjectNormalizer::isAllowedAttribute of the component Serializer ObjectNormalizer. The
CVE-2026-112913 | tox-dev filelock up to 4.2.0 ReadWriteLock _read_write.py _connect privileges management (Nessus ID 377466)
A vulnerability categorized as problematic has been discovered in tox-dev filelock up to 4.2.0. Affected by this issue is the function _connect of the file src/filelock/_read_write.py of the component ReadWriteLock. Such manipulation leads
CVE-2026-122329 | libsdl-org SDL_mixer up to 3.2.4 AIFF Decoder src/decoder_aiff.c FetchXLaw stack-based overflow (Nessus ID 377467)
A vulnerability has been found in libsdl-org SDL_mixer up to 3.2.4 and classified as problematic. This affects the function FetchXLaw of the file src/decoder_aiff.c of the component AIFF Decoder. The manipulation leads to stack-based buffer
CVE-2026-97371 | ntop ntopng up to 6.7.260720 reloadBlacklist src/IpAddress.cpp ndpi_get_custom_category_match stack-based overflow (Nessus ID 377468)
A vulnerability was found in ntop ntopng up to 6.7.260720 and classified as problematic. The impacted element is the function ndpi_get_custom_category_match of the file src/IpAddress.cpp of the component reloadBlacklist. The manipulation re
CVE-2026-100082 | Linux Kernel up to 7.3.2 xen-blkback use after free (Nessus ID 377469)
A vulnerability was found in Linux Kernel up to 7.3.2. It has been classified as very critical. This issue affects some unknown processing of the component xen-blkback. This manipulation causes use after free. This vulnerability appears as
Sicherheitslücke in Microsoft Paint: Update kommt nicht überall an
Microsoft hat eine Codeausführungslücke in Paint geschlossen. Die korrigierte Version 11.2609.401.0 kommt aber teils nicht über den Microsoft Store an. In der Windows-App Paint steckt eine Sicherheitslücke, über die Angreifer aus der Ferne
SSHole, APT-Root und kompromittierte Updates: Cyberangriffe im Wochenrückblick
LONDON (IT BOLTWISE) – Angreifer nutzen diese Woche mehrere kritisch bewertete Schwachstellen und legen dabei besonderes Gewicht auf unbeachtete Konfigurationsdetails. Bei OpenSSH ermöglicht SSHole laut CVE-2026-123158 Anmeldungen ohne gese
CVE-2026-43251 | Linux Kernel up to 6.19.5 input_mapping denial of service
A vulnerability labeled as critical has been found in Linux Kernel up to 6.19.5. Affected by this vulnerability is the function input_mapping. Executing a manipulation can lead to denial of service. The identification of this vulnerability
CVE-2026-43243 | Linux Kernel up to 6.12.74/6.18.15/6.19.5 AMD Display get_phyd32clk_src denial of service
A vulnerability was found in Linux Kernel up to 6.12.74/6.18.15/6.19.5. It has been rated as critical. This affects the function get_phyd32clk_src of the component AMD Display. This manipulation causes denial of service. This vulnerability
CVE-2026-43223 | Linux Kernel up to 6.19.5 pvr2_send_request_ex memory leak
A vulnerability has been found in Linux Kernel up to 6.19.5 and classified as critical. This affects the function pvr2_send_request_ex. Performing a manipulation results in memory leak. This vulnerability was named CVE-2026-43223. The attac
CVE-2026-43195 | Linux Kernel up to 6.18.15/6.19.5 buffer overflow
A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.18.15/6.19.5. This affects an unknown function. Executing a manipulation can lead to buffer overflow. This vulnerability appears as CVE-2026-43195. The att
CVE-2026-43189 | Linux Kernel up to 6.6.127/6.12.74/6.18.15/6.19.5 v4l2_async_match_notify null pointer dereference
A vulnerability was found in Linux Kernel up to 6.6.127/6.12.74/6.18.15/6.19.5. It has been rated as critical. This impacts the function v4l2_async_match_notify. The manipulation leads to null pointer dereference. This vulnerability is list
CVE-2026-113702 | iomad up to 4.5.15/5.0.11/5.1.8/5.2.4 PDF Certificate lib.php local_iomad_pluginfile authorization (Issue 2817)
A vulnerability, which was classified as problematic, was found in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this vulnerability is the function local_iomad_pluginfile in the library public/local/iomad/lib.php of the component PDF C
CVE-2026-37461 | gobgp 4.3.0 BGP /bgp/bgp.go ParseIP6Extended out-of-bounds
A vulnerability, which was classified as problematic, has been found in gobgp 4.3.0. This issue affects the function ParseIP6Extended of the file /bgp/bgp.go of the component BGP Handler. This manipulation causes out-of-bounds read. This vu
CVE-2026-31205 | Pluck CMS up to 4.7.20 editpage.php sanitizePageContent cross site scripting (ID 141)
A vulnerability classified as problematic was found in Pluck CMS up to 4.7.20. This affects the function sanitizePageContent of the file editpage.php. Such manipulation leads to cross site scripting. This vulnerability is uniquely identifie
CVE-2026-121623 | SensioLabs Symfony up to 5.4.55/6.4.49/7.4.22/8.1.10 Serializer denormalize path traversal (Nessus ID 377472)
A vulnerability was found in SensioLabs Symfony up to 5.4.55/6.4.49/7.4.22/8.1.10. It has been declared as problematic. Affected by this issue is the function DataUriNormalizer::denormalize of the component Serializer. Executing a manipulat
CVE-2026-120222 | undici up to 7.30.1/8.12.3 Cache Interceptor escape output (Nessus ID 377471)
A vulnerability, which was classified as problematic, was found in undici up to 7.30.1/8.12.3. Affected is an unknown function of the component Cache Interceptor. Such manipulation leads to escaping of output. This vulnerability is traded a
CVE-2026-68984 | Samsung Semiconductor Exynos 1680 Exynos NPU integer overflow (Nessus ID 377474)
A vulnerability categorized as very critical has been discovered in Samsung Semiconductor Exynos 2100, Exynos 1280, Exynos 2200, Exynos 1380, Exynos 1480, Exynos 2400, Exynos 1580, Exynos 2500, Exynos 2600 and Exynos 1680. Affected is an un
CVE-2026-111062 | russh 0.34.0-beta.1/0.63.3 Publickey Authentication encrypted.rs server_read_auth_request_pk signature verification (Nessus ID 377473)
A vulnerability was found in russh 0.34.0-beta.1/0.63.3. It has been classified as critical. The affected element is the function server_read_auth_request_pk of the file russh/src/server/encrypted.rs of the component Publickey Authenticatio
CVE-2026-122328 | SDL SDL_mixer up to 3.2.4 WAV file src/decoder_wav.c FetchXLaw stack-based overflow (Nessus ID 377476)
A vulnerability was found in SDL SDL_mixer up to 3.2.4. It has been classified as critical. Affected is the function FetchXLaw of the file src/decoder_wav.c of the component WAV file Handler. This manipulation causes stack-based buffer over
CVE-2026-100080 | Linux Kernel up to 7.3.2 xen-netback synchronize_net use after free (Nessus ID 377475)
A vulnerability categorized as very critical has been discovered in Linux Kernel up to 7.3.2. The impacted element is the function synchronize_net of the component xen-netback. Executing a manipulation can lead to use after free. This vulne
CVE-2026-18836 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended des
CVE-2026-18689 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accep
CVE-2026-17428 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization
CVE-2026-17411 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized befo
CVE-2026-17410 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
CVE-2026-17409 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access c
CVE-2026-17408 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
CVE-2026-17407 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before
CVE-2026-17406 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the s
CVE-2026-17405 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm
CVE-2026-17404 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17403 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
CVE-2026-17402 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is pas
CVE-2026-17401 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
CVE-2026-17400 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17399 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not suffic
CVE-2026-17398 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17397 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17396 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17395 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently restricted, which could allow the server to be made to contact internal systems.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently r
CVE-2026-17394 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should be controlled by the system, which could expose sensitive information.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could
CVE-2026-17392 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neut
CVE-2026-17391 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17390 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to execute arbitrary JavaScript in the web UI due to cross-site scripting. This could alter the intended functionality of the page and potentially lead to credential disclosure within a trusted session.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to execute arbitrary JavaScript in the web UI due to cross-site scripting. This could alter the intended functionality of the page an
CVE-2026-17389 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information from the connected LDAP directory due to LDAP injection. Input is not properly neutralized in directory lookups, which could cause queries to return additional data.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information from the connected LDAP directory due to LDAP injection. Input is not properly neutralized in directory l
CVE-2026-17388 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17387 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17385 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17383 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.