Skip to content
OpenAdvisories

Product · IBM

API Connect

287 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

52 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-17066

    Multiple Vulnerabilities in IBM API Connect

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify or delete data belonging to other tenants due to missing authorization.

    IBM API Connect
  • Critical 9.9
    CVE-2026-17049

    Multiple Vulnerabilities in IBM API Connect

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify arbitrary documents due to authorization bypass through user-controlled keys.

    IBM API Connect
  • Critical 9.9
    CVE-2026-16920

    Multiple Vulnerabilities in IBM API Connect

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to a confused deputy vulnerability.

    IBM API Connect
  • Critical 9.3
    CVE-2026-16918

    Multiple Vulnerabilities in IBM API Connect

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources due to server-side request forgery.

    IBM API Connect
  • Critical 9.9
    CVE-2026-16884

    Multiple Vulnerabilities in IBM API Connect

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection.

    IBM API Connect
  • Critical 9.8
    CVE-2026-16720

    Multiple Vulnerabilities in IBM API Connect

    IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain valid access tokens for other users due to improper authentication. Authentication against a connected directory service is not sufficiently enfor…

    IBM API Connect
  • Critical 9.8
    CVE-2026-17362

    Multiple Vulnerabilities in IBM API Connect

    IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to create, modify, or delete tenants due to missing authorization.

    IBM API Connect
  • Critical 9.1
    CVE-2026-9074

    IBM API Connect SQL Injection

    IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.

    IBM API Connect
  • Critical 9.8
    CVE-2025-13915

    Authentication bypass in IBM API Connect

    IBM API Connect 10.0.8.0 through 10.0.8.5, and 10.0.11.0 could allow a remote attacker to bypass authentication mechanisms and gain unauthorized access to the application.

    IBM API Connect
  • Critical 10.0
    CVE-2019-4202

    IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially c…

    IBM API Connect
  • Critical 9.0
    CVE-2019-4008

    API Connect V2018.1 through 2018.4.1.1 is impacted by access token leak. Authorization tokens in some URLs can result i…

    IBM API Connect
  • Critical 9.8
    CVE-2018-1469

    IBM API Connect Developer Portal 5.0.0.0 through 5.0.8.2 could allow an unauthenticated attacker to execute system comm…

    IBM API Connect