Security alerts

1,054 alerts · page 14 of 53

1. Critical (CVSS 9+) Published 2026-11-07 06:32 · updated 2026-11-10 18:25

   CVE-2026-17292 Multiple Vulnerabilities in IBM API Connect

   Critical·CVSS 9.1 EPSS 0.40%

   Exploit status: No public exploit known

   Affects: ibm api connect

   IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to take over ownership of other organizations due to broken object-level authorization. Access checks on organization objects are incomplete, which could allow own...

2. Critical (CVSS 9+) Published 2026-11-07 06:32 · updated 2026-11-11 07:19

   CVE-2026-17291 Multiple Vulnerabilities in IBM API Connect

   Critical·CVSS 9.0 EPSS 0.53%

   Exploit status: No public exploit known

   Affects: ibm api connect

   IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform account takeover due to an open redirect vulnerability. The redirect address used during OAuth 2.0 sign-in is not sufficiently validated, which could al...

3. Critical (CVSS 9+) Published 2026-11-07 06:32 · updated 2026-11-11 07:19

   CVE-2026-17280 Multiple Vulnerabilities in IBM API Connect

   Critical·CVSS 9.1 EPSS 0.57%

   Exploit status: No public exploit known

   Affects: ibm api connect

   IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to perform unauthenticated brute-force attacks to obtain valid credentials due to improper restriction of excessive authentication attempts.

4. Critical (CVSS 9+) Published 2026-11-07 06:32 · updated 2026-11-11 13:17

   CVE-2026-17158 Multiple Vulnerabilities in IBM API Connect

   Critical·CVSS 9.9 EPSS 0.66%

   Exploit status: No public exploit known

   Affects: ibm api connect

   IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain elevated privileges due to improper authentication.

5. Critical (CVSS 9+) Published 2026-11-07 06:32 · updated 2026-11-11 13:17

   CVE-2026-17150 Multiple Vulnerabilities in IBM API Connect

   Critical·CVSS 9.9 EPSS 0.80%

   Exploit status: No public exploit known

   Affects: ibm api connect

   IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants due to insufficient input validation. Uploaded custom module content is not sufficien...

6. Critical (CVSS 9+) Published 2026-11-07 06:32 · updated 2026-11-11 07:19

   CVE-2026-17146 Multiple Vulnerabilities in IBM API Connect

   Critical·CVSS 9.9 EPSS 0.67%

   Exploit status: No public exploit known

   Affects: ibm api connect

   IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information due to improper input validation.

7. Critical (CVSS 9+) Published 2026-11-07 06:31 · updated 2026-11-10 21:21

   CVE-2026-17134 Multiple Vulnerabilities in IBM API Connect

   Critical·CVSS 9.9 EPSS 0.46%

   Exploit status: No public exploit known

   Affects: ibm api connect

   IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection.

8. Critical (CVSS 9+) Published 2026-11-07 06:31 · updated 2026-11-10 21:21

   CVE-2026-17132 Multiple Vulnerabilities in IBM API Connect

   Critical·CVSS 9.9 EPSS 0.62%

   Exploit status: No public exploit known

   Affects: ibm api connect

   IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

9. Critical (CVSS 9+) Published 2026-11-07 06:31

   CVE-2026-17131 Multiple Vulnerabilities in IBM API Connect

   Critical·CVSS 9.3 EPSS 0.44%

   Exploit status: No public exploit known

   Affects: ibm api connect

   IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to contact unintended destinations and return the response.

10. Critical (CVSS 9+) Published 2026-11-07 06:31 · updated 2026-11-09 17:17

    CVE-2026-17117 Multiple Vulnerabilities in IBM API Connect

    Critical·CVSS 9.9 EPSS 0.80%

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improperly controlled modification of object attributes. A user could set a field that should only be controlled by the system, wh...

11. Critical (CVSS 9+) Published 2026-11-07 06:31 · updated 2026-11-10 21:21

    CVE-2026-17066 Multiple Vulnerabilities in IBM API Connect

    Critical·CVSS 9.1 EPSS 0.56%

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify or delete data belonging to other tenants due to missing authorization.

12. Critical (CVSS 9+) Published 2026-11-07 06:31 · updated 2026-11-10 21:21

    CVE-2026-17049 Multiple Vulnerabilities in IBM API Connect

    Critical·CVSS 9.9 EPSS 0.51%

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify arbitrary documents due to authorization bypass through user-controlled keys.

13. Critical (CVSS 9+) Published 2026-11-07 06:31 · updated 2026-11-10 22:19

    CVE-2026-16920 Multiple Vulnerabilities in IBM API Connect

    Critical·CVSS 9.9 EPSS 0.50%

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to a confused deputy vulnerability.

14. Critical (CVSS 9+) Published 2026-11-07 06:31 · updated 2026-11-10 18:51

    CVE-2026-16918 Multiple Vulnerabilities in IBM API Connect

    Critical·CVSS 9.3 EPSS 0.42%

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources due to server-side request forgery.

15. Critical (CVSS 9+) Published 2026-11-07 06:31 · updated 2026-11-11 07:19

    CVE-2026-16884 Multiple Vulnerabilities in IBM API Connect

    Critical·CVSS 9.9 EPSS 0.50%

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection.

16. Critical (CVSS 9+) Published 2026-11-07 06:31 · updated 2026-11-10 18:56

    CVE-2026-16720 Multiple Vulnerabilities in IBM API Connect

    Critical·CVSS 9.8 EPSS 0.77%

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain valid access tokens for other users due to improper authentication. Authentication against a connected directory service is not sufficiently enforced, which could allo...

17. CISA KEV addition Critical (CVSS 9+) Published 2026-11-07 05:47 · updated 2026-11-10 15:49

    CVE-2026-123218 IBM Aspera Faspex Authorization Bypass

    Critical·CVSS 9.8 EPSS 0.53% CISA KEV added 2026-11-09 · due 2026-11-12 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: ibm Aspera Faspex

    IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.

18. Critical (CVSS 9+) Published 2026-11-07 05:28 · updated 2026-11-08 21:17

    CVE-2026-19803 Printcart Store <= 2.13.2 - Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' Parameter

    Critical·CVSS 9.8 EPSS 0.96%

    Exploit status: No public exploit known

    Affects: Printcart Store – Web to Print Product Designer for WooCommerce, wordpress printcart-integration

    The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.13.2. This is due to the nbu_crop_image AJAX handler accepting a user-supplied url parameter that Nbdesigner_IO:...

19. Critical (CVSS 9+) Published 2026-11-07 05:25 · updated 2026-11-10 18:58

    CVE-2026-17362 Multiple Vulnerabilities in IBM API Connect

    Critical·CVSS 9.8 EPSS 0.58%

    Exploit status: No public exploit known

    Affects: ibm api connect

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to create, modify, or delete tenants due to missing authorization.

20. Critical (CVSS 9+) Published 2026-11-07 04:29 · updated 2026-11-08 21:17

    CVE-2026-93754 payever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution

    Critical·CVSS 9.8 EPSS 0.87%

    Exploit status: No public exploit known

    Affects: wordpress payever-woocommerce-gateway, payever Checkout – Composable Payment Gateway

    The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in various versions up to, and including, 4.8.0. Three WooCommerce-API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_sync...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).