Export limit exceeded: 420867 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 420867 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 420867 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 420867 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found '/' (at char 31), (line:1, col:32)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (420867 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-17370 1 Ibm 1 Api Connect 2026-11-07 6.4 Medium
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain an access token for another user due to improper authentication. The sign-in flow does not sufficiently verify the identity of the user completing it, which could allow another user's identity to be assumed.
CVE-2026-17369 1 Ibm 1 Api Connect 2026-11-07 5.4 Medium
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link the victim's session to an account controlled by the attacker.
CVE-2026-17368 1 Ibm 1 Api Connect 2026-11-07 6.8 Medium
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform network reconnaissance and obtain sensitive credentials due to server-side request forgery. The server can be made to send requests to unintended destinations and return the results.
CVE-2026-17367 1 Ibm 1 Api Connect 2026-11-07 5.4 Medium
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.
CVE-2026-17366 1 Ibm 1 Api Connect 2026-11-07 5 Medium
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
CVE-2026-17365 1 Ibm 1 Api Connect 2026-11-07 8.5 High
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17363 1 Ibm 1 Api Connect 2026-11-07 7.7 High
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
CVE-2026-17361 1 Ibm 1 Api Connect 2026-11-07 7.7 High
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17360 1 Ibm 1 Api Connect 2026-11-07 9.8 Critical
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
CVE-2026-17359 1 Ibm 1 Api Connect 2026-11-07 9.9 Critical
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. A user-supplied value can influence code that the product generates, which could lead to code execution.
CVE-2026-17358 1 Ibm 1 Api Connect 2026-11-07 8.2 High
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication across tenants due to improper authentication. Authentication checks are not sufficiently isolated between tenants, which could allow a user from one tenant to be accepted by another.
CVE-2026-17357 1 Ibm 1 Api Connect 2026-11-07 7.6 High
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access internal network services due to server-side request forgery.
CVE-2026-17356 1 Ibm 1 Api Connect 2026-11-07 8.7 High
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to the use of a hard-coded cryptographic key.
CVE-2026-17355 1 Ibm 1 Api Connect 2026-11-07 8.2 High
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from internal network resources due to server-side request forgery. Destination checks on outbound requests can be bypassed, which could allow the server to reach internal systems that should be blocked.
CVE-2026-17354 1 Ibm 1 Api Connect 2026-11-07 9.9 Critical
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file writes due to path traversal.
CVE-2026-17353 1 Ibm 1 Api Connect 2026-11-07 9.6 Critical
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to server-side request forgery.
CVE-2026-17352 1 Ibm 1 Api Connect 2026-11-07 8.5 High
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-17345 1 Ibm 1 Api Connect 2026-11-07 7.7 High
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.
CVE-2026-17344 1 Ibm 1 Api Connect 2026-11-07 9.3 Critical
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. A service that can be reached without authentication could be made to send requests to unintended destinations.
CVE-2026-17343 1 Ibm 1 Api Connect 2026-11-07 8.1 High
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authorization checks to access or modify sensitive information due to improper authorization.