Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 786 | 0,2 % |
| ≥50 % | 3.561 | 0,9 % |
| ≥10 % | 13.157 | 3,2 % |
| <10 % | 396.051 | 95,8 % |
🗂️ …
CVE-2025-68337 | Linux Kernel up to 6.12.61/6.17.11/6.18.0 fs/jbd2/transaction.c jbd2_journal_get_create_access allocation of resources (EUVD-2025-204730 / Nessus ID 279566)
A vulnerability identified as critical has been detected in Linux Kernel up to 6.12.61/6.17.11/6.18.0. This issue affects the function jbd2_journal_get_create_access of the file fs/jbd2/transaction.c. This manipulation causes allocation of
CVE-2023-53960 | SOUND4 WM2 up to 2.x POST Parameter index.php password sql injection (Exploit 51171 / EUVD-2023-60245)
A vulnerability was found in SOUND4 Impact, Pulse, First, Pulse Eco, BigVoice4, BigVoice2, Stream and WM2 up to 2.x and classified as critical. Impacted is an unknown function of the file index.php of the component POST Parameter Handler. T
CVE-2022-50705 | Linux Kernel up to 5.15.89/6.0.2 io_uring state issue (Nessus ID 279931 / WID-SEC-2025-2920)
A vulnerability categorized as critical has been discovered in Linux Kernel up to 5.15.89/6.0.2. This vulnerability affects unknown code of the component io_uring. Executing a manipulation can lead to state issue. This vulnerability is trac
CVE-2022-50704 | Linux Kernel up to 6.0.15/6.1.1 Gadget Driver use after free (Nessus ID 279785 / WID-SEC-2025-2920)
A vulnerability was found in Linux Kernel up to 6.0.15/6.1.1. It has been classified as critical. This vulnerability affects unknown code of the component Gadget Driver. Performing a manipulation results in use after free. This vulnerabilit
CVE-2022-50703 | Linux Kernel up to 6.0.2 qcom_smsm_probe iteration (Nessus ID 279972 / WID-SEC-2025-2920)
A vulnerability has been found in Linux Kernel up to 6.0.2 and classified as critical. Affected by this vulnerability is the function qcom_smsm_probe. Performing a manipulation results in excessive iteration. This vulnerability is cataloged
CVE-2022-50702 | Linux Kernel up to 5.15.86/6.0.18/6.1.4 vdpa_sim vdpasim_net_init memory leak (Nessus ID 279945 / WID-SEC-2025-2920)
A vulnerability was found in Linux Kernel up to 5.15.86/6.0.18/6.1.4. It has been rated as critical. This vulnerability affects the function vdpasim_net_init of the component vdpa_sim. The manipulation leads to memory leak. This vulnerabili
CVE-2022-50701 | Linux Kernel up to 6.1.15/6.2.2 wifi sg_copy_buffer out-of-bounds write (Nessus ID 279918 / WID-SEC-2025-2920)
A vulnerability was found in Linux Kernel up to 6.1.15/6.2.2 and classified as critical. This affects the function sg_copy_buffer of the component wifi. Such manipulation leads to out-of-bounds write. This vulnerability is uniquely identifi
CVE-2022-50700 | Linux Kernel up to 6.0.15/6.1.1 Host Driver err_qdi.c denial of service (Nessus ID 279742 / WID-SEC-2025-2920)
A vulnerability was found in Linux Kernel up to 6.0.15/6.1.1. It has been rated as critical. This affects an unknown part of the file err_qdi.c of the component Host Driver. Performing a manipulation results in denial of service. This vulne
CVE-2026-80842 | Linux Kernel up to 7.2.2 Bridge Multicast br_multicast_toggle_one_vlan use after free (Nessus ID 378743)
A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 7.2.2. The impacted element is the function br_multicast_toggle_one_vlan of the component Bridge Multicast. This manipulation causes use after free
Linux Kernel Use-After-Free Vulnerability: What’s Happening and Why It Matters
Linux does a lot of work behind the scenes. It handles memory, manages network connections, runs applications, and keeps everything working together. We don’t usually think about any of this because, well, it’s supposed to just work.But wha
Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation
Zoom has released software updates to address two security flaws impacting Zoom Workplace for Windows, including a critical bug that could result in privilege escalation on affected systems. The vulnerabilities are listed below – CVE-2026-1
GitHub Release: nodejs/node v22.23.5 (11.11.2026)
🛡️ Security Fix nodejs/nodev22.23.511.11.2026@aduh95This is a security release. Notable Changes (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High (CVE-2026-123864) tls,http: prevent nested parser exe
CVE-2025-68291 | Linux Kernel up to 6.12.60/6.17.10 tcp_send_active_reset divide by zero (EUVD-2025-203789 / Nessus ID 298404)
A vulnerability was found in Linux Kernel up to 6.12.60/6.17.10 and classified as critical. Affected is the function tcp_send_active_reset. Such manipulation leads to divide by zero. This vulnerability is referenced as CVE-2025-68291. The a
CVE-2025-68266 | Linux Kernel up to 6.12.61/6.17.11 bfs initialization (EUVD-2025-203747 / Nessus ID 298404)
A vulnerability has been found in Linux Kernel up to 6.12.61/6.17.11 and classified as critical. This vulnerability affects unknown code of the component bfs. Performing a manipulation results in improper initialization. This vulnerability
CVE-2024-12741 | NI DAQExpress up to 5.1 Project File deserialization
A vulnerability marked as very critical has been reported in NI DAQExpress up to 5.1. This affects an unknown part of the component Project File Handler. Performing a manipulation results in deserialization. This vulnerability only affects
CVE-2022-50686 | Kentico Xperience up to 12.0 information exposure (EUVD-2025-204356)
A vulnerability classified as problematic has been found in Kentico Xperience up to 12.0. This vulnerability affects unknown code. This manipulation causes information exposure through error message. This vulnerability appears as CVE-2022-5
CVE-2022-50685 | Kentico Xperience up to 13.0.56 XML File Parser cross site scripting (EUVD-2025-204339)
A vulnerability was found in Kentico Xperience up to 13.0.56. It has been rated as problematic. This vulnerability affects unknown code of the component XML File Parser. The manipulation leads to cross site scripting. This vulnerability is
CVE-2022-50684 | Kentico Xperience up to 13.0.71 Form Submission cross site scripting (EUVD-2025-204348)
A vulnerability was found in Kentico Xperience up to 13.0.71. It has been classified as problematic. This impacts an unknown function of the component Form Submission Handler. This manipulation causes cross site scripting. The identificatio
CVE-2022-50683 | Kentico Xperience up to 13.0.74 Setting cross site scripting (EUVD-2025-204352)
A vulnerability described as problematic has been identified in Kentico Xperience up to 13.0.74. Impacted is an unknown function of the component Setting Handler. Such manipulation leads to cross site scripting. This vulnerability is docume
CVE-2022-50682 | Kentico Xperience up to 13.0.79 crlf injection
A vulnerability, which was classified as problematic, was found in Kentico Xperience up to 13.0.79. The affected element is an unknown function. Executing a manipulation can lead to crlf injection. This vulnerability is handled as CVE-2022-
CVE-2022-50681 | Kentico Xperience up to 13.0.88 cross site scripting (EUVD-2025-204343)
A vulnerability marked as problematic has been reported in Kentico Xperience up to 13.0.88. This issue affects some unknown processing. This manipulation causes cross site scripting. This vulnerability is registered as CVE-2022-50681. Remot
CVE-2022-50680 | Kentico Xperience up to 13.0.92 cross site scripting (EUVD-2025-204366)
A vulnerability labeled as problematic has been found in Kentico Xperience up to 13.0.92. This vulnerability affects unknown code. The manipulation results in cross site scripting. This vulnerability is cataloged as CVE-2022-50680. The atta
CVE-2025-68265 | Linux Kernel up to 6.12.61/6.17.11 nvme request_queue use after free (EUVD-2025-203749 / Nessus ID 299530)
A vulnerability labeled as critical has been found in Linux Kernel up to 6.12.61/6.17.11. This affects the function request_queue of the component nvme. The manipulation results in use after free. This vulnerability is reported as CVE-2025-
CVE-2025-68264 | Linux Kernel up to 6.12.61/6.17.11/6.18.0 ext4 ext4_update_inline_data/ext4_create_inline_data denial of service (EUVD-2025-203738 / Nessus ID 296481)
A vulnerability was found in Linux Kernel up to 6.12.61/6.17.11/6.18.0 and classified as critical. This issue affects the function ext4_update_inline_data/ext4_create_inline_data of the component ext4. Executing a manipulation can lead to d
CVE-2025-68261 | Linux Kernel up to 6.12.61/6.17.11/6.18.0 fs/ext4/indirect.c ext4_destroy_inline_data_nolock buffer overflow (EUVD-2025-203741 / Nessus ID 298404)
A vulnerability marked as critical has been reported in Linux Kernel up to 6.12.61/6.17.11/6.18.0. This affects the function ext4_destroy_inline_data_nolock of the file fs/ext4/indirect.c. Performing a manipulation results in buffer overflo
CVE-2025-68206 | Linux Kernel up to 6.17.8 nf_nat_setup_info state issue (Nessus ID 296481 / WID-SEC-2025-2868)
A vulnerability was found in Linux Kernel up to 6.17.8 and classified as critical. This vulnerability affects the function nf_nat_setup_info. Such manipulation leads to state issue. This vulnerability is documented as CVE-2025-68206. The at
CVE-2023-4570 | NI MeasurementLink Python Services 1.1.0 unprotected alternate channel
A vulnerability classified as critical has been found in NI MeasurementLink Python Services 1.1.0. The affected element is an unknown function. Performing a manipulation results in unprotected alternate channel. This vulnerability is identi
Git fixes six vulnerabilities, including code execution during recursive clones
The Git project has released security updates addressing six vulnerabilities that could allow attackers to execute code, write to unintended files or cause memory corruption when Git processes malicious repositories or other specially prepa
Microsoft-Patch-Flut im November: Über 1000 Fixes - IT-Administrator.de
Besonders heikel ist CVE-2026-116928 in Windows Search (CVSS 9,8). Ein Angreifer schickt einfach einen bösartigen Anhang an einen Exchange-Server, der ... Weiterlesen
CVE-2025-40261 | Linux Kernel up to 6.6.117/6.12.59/6.17.9 nvme_fc_delete_ctrl information disclosure (EUVD-2025-201196 / Nessus ID 277521)
A vulnerability classified as critical was found in Linux Kernel up to 6.6.117/6.12.59/6.17.9. This affects the function nvme_fc_delete_ctrl. The manipulation results in information disclosure. This vulnerability is known as CVE-2025-40261.
CVE-2025-40196 | Linux Kernel up to 6.6.113/6.12.53/6.17.3 kernel/workqueue.c quota_release_work denial of service (Nessus ID 275347 / WID-SEC-2025-2595)
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.6.113/6.12.53/6.17.3. This affects the function quota_release_work of the file kernel/workqueue.c. This manipulation causes denial of service. This vu
CVE-2022-4985 | Vodacom Vodafone H500s up to 3.5.10 HTTP Endpoint /data/activation.json wifi_password information expsure (Exploit 50636 / EUVD-2022-55681)
A vulnerability was found in Vodacom Vodafone H500s up to 3.5.10. It has been declared as problematic. The impacted element is an unknown function of the file /data/activation.json of the component HTTP Endpoint. Executing a manipulation of
SignDrop: Ungepatchter Windows-Zero-Day nutzt Microsofts CLFS-Schutzmaßnahme aus
... Windows-Schwachstelle veröffentlicht. ... Getestet wurde die Lücke unter Windows 11 26H2, Windows 11 26H2 Experimental und Windows Server 2025 ... Weiterlesen
Microsoft Patchday November 2026: Outlook-Lücke aktiv ausgenutzt - Security-Insider
Den Fix liefert das Windows-Update auf dem Exchange-Server. Bei CVE-2026-118207 in Exchange Server SE mit einem CVSS-Score von 8.8 können Angreifer ... Weiterlesen
CVE-2026-18836 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended des
CVE-2026-18689 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accep
CVE-2026-17428 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without sufficient verification, which could allow access to information belonging to others.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization
CVE-2026-17411 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized befo
CVE-2026-17410 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
CVE-2026-17409 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access c
CVE-2026-17408 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
CVE-2026-17407 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before
CVE-2026-17406 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the s
CVE-2026-17405 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm
CVE-2026-17404 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17403 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
CVE-2026-17402 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is pas
CVE-2026-17401 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
CVE-2026-17400 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17399 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not suffic
CVE-2026-17398 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17397 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17396 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17395 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently restricted, which could allow the server to be made to contact internal systems.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network resources due to improper validation of a user-supplied URL. Destinations are not sufficiently r
CVE-2026-17394 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should be controlled by the system, which could expose sensitive information.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could
CVE-2026-17392 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neut
CVE-2026-17391 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17390 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to execute arbitrary JavaScript in the web UI due to cross-site scripting. This could alter the intended functionality of the page and potentially lead to credential disclosure within a trusted session.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to execute arbitrary JavaScript in the web UI due to cross-site scripting. This could alter the intended functionality of the page an
CVE-2026-17389 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information from the connected LDAP directory due to LDAP injection. Input is not properly neutralized in directory lookups, which could cause queries to return additional data.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information from the connected LDAP directory due to LDAP injection. Input is not properly neutralized in directory l
CVE-2026-17388 | IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.