Filtered by vendor Ibm Subscriptions
Total 9872 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-16884 1 Ibm 1 Api Connect 2026-11-11 9.9 Critical
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection.
CVE-2026-108178 1 Ibm 1 Api Connect 2026-11-11 4.2 Medium
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a token to be accepted that should be rejected due to an improperly implemented security check. Under certain conditions, token validation is incomplete, so a token may be accepted for a purpose it was not intended for.
CVE-2026-93744 1 Ibm 1 I 2026-11-11 6.5 Medium
IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to authentication, a bad actor could exploit this vulnerability to alter server-side session security state.
CVE-2026-17339 1 Ibm 1 Api Connect 2026-11-10 9.1 Critical
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access or delete resources belonging to other tenants due to path traversal.
CVE-2026-17321 1 Ibm 1 Api Connect 2026-11-10 8.1 High
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to delete or overwrite arbitrary control-plane assets due to an insecure direct object reference.
CVE-2026-17155 1 Ibm 1 Api Connect 2026-11-10 5.4 Medium
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of user-controlled input.
CVE-2026-16920 1 Ibm 1 Api Connect 2026-11-10 9.9 Critical
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to a confused deputy vulnerability.
CVE-2026-18142 1 Ibm 1 Mq 2026-11-10 7.1 High
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow a remote authenticated attacker to cause a denial of service and perform limited memory corruption due to an integer overflow.
CVE-2026-17336 1 Ibm 1 Api Connect 2026-11-10 9.9 Critical
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
CVE-2026-17319 1 Ibm 1 Api Connect 2026-11-10 7.1 High
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify tool configuration and cause a denial of service due to improper authorization. Information supplied by the client is relied on when deciding what a user is allowed to do, which could allow unauthorized changes that disrupt service.
CVE-2026-17311 1 Ibm 1 Api Connect 2026-11-10 7.1 High
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify application API subscriptions due to broken object-level authorization.
CVE-2026-17066 1 Ibm 1 Api Connect 2026-11-10 9.1 Critical
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify or delete data belonging to other tenants due to missing authorization.
CVE-2026-17049 1 Ibm 1 Api Connect 2026-11-10 9.9 Critical
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify arbitrary documents due to authorization bypass through user-controlled keys.
CVE-2026-16725 1 Ibm 1 Watson Speech Services Cartridge 2026-11-10 6.5 Medium
IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote authenticated attacker to read arbitrary files from the local filesystem due to path traversal.
CVE-2026-17493 1 Ibm 1 Watson Speech Services Cartridge 2026-11-10 7.5 High
IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
CVE-2026-19319 1 Ibm 1 Watson Speech Services Cartridge 2026-11-10 5.3 Medium
IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
CVE-2026-82418 1 Ibm 1 Watson Speech Services Cartridge 2026-11-10 9.8 Critical
IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to execute arbitrary code due to a use-after-free vulnerability.
CVE-2026-96146 1 Ibm 1 Sevone Network Performance Management 2026-11-10 7.5 High
IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
CVE-2026-17437 1 Ibm 1 App Connect Enterprise 2026-11-10 5.5 Medium
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.29 could allow a local attacker to perform an arbitrary file write due to improper validation of pathnames during archive extraction.
CVE-2026-17355 1 Ibm 1 Api Connect 2026-11-10 8.2 High
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from internal network resources due to server-side request forgery. Destination checks on outbound requests can be bypassed, which could allow the server to reach internal systems that should be blocked.