CISA KEV (aktif exploit edilen açıklar) ve NVD'den otomatik toplanan güncel güvenlik açıkları (CVE) ve saldırı tipleri — önem derecesi, kategori ve aktif sömürü durumuyla. Yeni açıkları e-posta ile takip edin.
Kritik 10Bellek Bozulması (Taşma/UAF)
CVE-2026-123966
A vulnerability was determined in Tenda AC19 16.03.10.07. Affected by this issue is the function saveParentControlInfo of the file /goform/saveParentControlInfo. This manipulation of the argument deviceId causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Tenda AC19 16.03.10.07 cihazında /goform/saveParentControlInfo dosyasındaki saveParentControlInfo fonksiyonunda, deviceId parametresinin işlenmesi heap tabanlı buffer overflow'a yol açmaktadır; uzaktan sömürülebilen bu a…
Kritik 9.1Uzaktan Kod Çalıştırma (RCE)
CVE-2026-120984
A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during the setup process. This allows an authenticated attacker with client management permissions to bypass security controls and upload a malicious JavaScript policy, which is then ex
Keycloak'un istemci yönetimi bileşeninde, yetkilendirme servisleri etkin bir istemci oluşturulduğunda veya içe aktarıldığında kullanılan dahili oturum özniteliğinin düzgün temizlenmemesi nedeniyle, istemci yönetim iznine…
Kritik 9.1Kimlik Doğrulama / Yetki Atlatma
CVE-2026-122041
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wp_ajax and wp_ajax_nopriv and is gated solely by the 'file_handling_nonce' nonce, which is emitted inside t
WordPress için Checkout Field Editor for WooCommerce (Pro) eklentisinin 3.8.0 ve öncesi sürümlerinde, ajax_remove_uploaded() fonksiyonunda yetki/sahiplik kontrolü eksikliği nedeniyle saldırganlar rastgele ekleri silebili…
Kritik 9.8Yetki Yükseltme
CVE-2026-119075
The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields()) validates a submitted 'tgwcfb/user-roles' value against the form's configured allowed roles, but the checkout registrati
WooCommerce için Registration Form eklentisinin 1.1.4 ve öncesi sürümlerinde, ödeme sırasında kayıt yolundaki validate_checkout_fields() fonksiyonunda izin verilen roller listesinin kontrol edilmemesi nedeniyle ayrıcalık…
Kritik 9.1Kimlik Doğrulama / Yetki Atlatma
CVE-2026-118066
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeover in all versions up to, and including, 5.7.6. This is due to the `OsModel::build_conditions_query()` function in `lib/models/model.php` comparing WHERE-clause values against the literal strings `'IS NULL'` and `'IS NOT NULL'` and concatena
LatePoint eklentisinin 5.7.6 ve öncesi sürümlerinde, `OsModel::build_conditions_query()` fonksiyonunun `'IS NULL'`/`'IS NOT NULL'` değerlerini parametre olarak bağlamadan doğrudan SQL'e eklemesi nedeniyle kimlik doğrulam…
Kritik 9.8Kimlik Doğrulama / Yetki Atlatma
CVE-2026-104014
The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.0. This is due to the plugin's password-reset finalization endpoint (the wp_ajax_nopriv_ceovw_update_new_password action handled by CEOVW_AJAX::update_new_password()) authorizing the reset solely by the presence of a database row marking an email as 'V
WordPress için Naimur Email OTP Verification for WooCommerce eklentisinin 2.1.0 ve öncesi sürümlerinde kimlik doğrulama atlatma açığı var; şifre sıfırlama endpoint'i yalnızca e-postanın "VERIFIED" olarak işaretlendiği ve…
Kritik 9.9Bellek Bozulması (Taşma/UAF)
CVE-2026-123961
A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument KeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
TOTOLINK CA300-PoE 6.2c.884 cihazında /cgi-bin/cstecgi.cgi dosyasındaki setWiFiBasicConfig fonksiyonunda, KeyStr argümanının işlenmesiyle tetiklenen bir buffer overflow zafiyeti bulunmaktadır. Uzaktan sömürülebilen bu aç…
Kritik 9.9Bellek Bozulması (Taşma/UAF)
CVE-2026-123960
A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. This affects the function setWanConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument pppoeUser/priDns/secDns can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
TOTOLINK CA300-PoE 6.2c.884 cihazında, /cgi-bin/cstecgi.cgi dosyasındaki setWanConfig fonksiyonunda pppoeUser, priDns ve secDns parametrelerinin işlenmesi, uzaktan tetiklenebilen bir buffer overflow (tampon taşması) açığ…
Kritik 9.1Bellek Bozulması (Taşma/UAF)
CVE-2026-123959
A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. The impacted element is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument langType results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
TOTOLINK CA300-PoE 6.2c.884 cihazında /cgi-bin/cstecgi.cgi dosyasındaki setLanguageCfg fonksiyonunda, langType parametresinin manipüle edilmesiyle tetiklenen bir buffer overflow açığı bulunmaktadır; uzaktan sömürülebilen…
Kritik 9.9Bellek Bozulması (Taşma/UAF)
CVE-2026-123958
A vulnerability was identified in TOTOLINK CA300-PoE 6.2c.884. The affected element is the function setLanConfig of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument lanDns/lanSecDns/langType leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
TOTOLINK CA300-PoE 6.2c.884 cihazında /cgi-bin/cstecgi.cgi dosyasındaki setLanConfig fonksiyonunda, lanDns/lanSecDns/langType argümanlarının işlenmesiyle tetiklenen ve uzaktan sömürülebilen bir buffer overflow zafiyeti t…
Kritik 9.9Bellek Bozulması (Taşma/UAF)
CVE-2026-123957
A vulnerability was determined in TOTOLINK CA300-PoE 6.2c.884. Impacted is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ipStart causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
TOTOLINK CA300-PoE 6.2c.884 cihazında /cgi-bin/cstecgi.cgi dosyasındaki setIpQosRules fonksiyonunda, ipStart argümanının manipüle edilmesiyle tetiklenen bir buffer overflow zafiyeti bulunmaktadır; saldırı uzaktan gerçekl…
Yüksek 8.1Güvensiz Seri Hale Getirme
CVE-2026-104738
The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.10.2 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another p
WordPress'in Advanced Form Integration eklentisi 2.10.2 ve öncesi sürümlerde, güvenilmeyen girdilerin deserialize edilmesiyle kimlik doğrulaması gerektirmeyen PHP Nesne Enjeksiyonu açığı içerir; ancak tek başına etkisizd…
Yüksek 7.3Diğer / Sınıflandırılmamış
CVE-2026-123881
A vulnerability was found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This issue affects the function fetch_chat_record of the file im_server/app.py of the component Message Handler. The manipulation of the argument comm_id results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The project
OpenBMB Internet of Agents'ta im_server/app.py içindeki fetch_chat_record fonksiyonunda, comm_id parametresinin manipüle edilmesiyle erişim kontrollerinin atlatılmasına yol açan ve uzaktan sömürülebilen bir güvenlik açığ…
Yüksek 8.8Güvensiz Seri Hale Getirme
CVE-2026-87112
The QA Assistants – Driven by data plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.3.0 via the 'dlevent_ver' parameter. This is due to unrestricted PHP deserialization via wrap_unserialize_static() calling unserialize() without an allowed_classes restriction, combined with serialize_escape() failing to sanitize path traversal sequences in the raw_
WordPress'in QA Assistants – Driven by data eklentisi 5.3.0 ve öncesi sürümlerde, 'dlevent_ver' parametresi üzerinden sınıf kısıtlaması olmadan unserialize() çağrılması ve 'raw_name' parametresindeki dizin geçiş dizileri…
Yüksek 7.2XSS — Siteler Arası Betik
CVE-2026-122037
The AgenWebsite Shipping – Plugin Ongkos Kirim & Generate Resi Otomatis Semua Kurir Indonesia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'zipcode' parameter in all versions up to, and including, 9.2.41 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will exe
WordPress için AgenWebsite Shipping eklentisinin 9.2.41 ve öncesi sürümlerinde, 'zipcode' parametresinin yeterince temizlenmemesi ve çıktının kaçışlanmaması nedeniyle kimlik doğrulaması gerektirmeyen saldırganların sayfa…
Yüksek 7.2XSS — Siteler Arası Betik
CVE-2026-120537
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (storage); originals / language / original_language (exfiltration from endpoint)' parameter in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker
WordPress'in TranslatePress eklentisi, 3.3.8 ve öncesi tüm sürümlerinde, 'comment (storage); originals / language / original_language' parametresi üzerinden yetersiz girdi temizleme ve çıktı kaçışı nedeniyle Stored Cross…
Yüksek 7.2XSS — Siteler Arası Betik
CVE-2026-116558
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<title>/<description> inside the attacker-controlled RSS feed body' parameter in all versions up to, and including, 2.0.26 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will e
WordPress'in Unlimited Elements for Elementor eklentisi 2.0.26 ve öncesi sürümlerde, saldırganın kontrol ettiği RSS beslemesindeki title/description alanlarının yetersiz temizlenmesi ve kaçışlanmaması nedeniyle kalıcı XS…
Yüksek 7.2XSS — Siteler Arası Betik
CVE-2026-115811
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'star_rating' parameter in all versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful executi
WordPress Strong Testimonials eklentisinin 3.3.16 ve öncesi sürümlerinde, 'star_rating' parametresindeki yetersiz girdi temizleme ve çıktı kaçışlama nedeniyle kimlik doğrulaması olmayan saldırganlar, bir yönetici bekleye…
Yüksek 7.2SSRF — Sunucu Taraflı İstek
CVE-2026-75590
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources and obtain sensitive information due to server-side request forgery. A protection that blocks requests to internal addresses can be bypassed, so the server could be made to contact internal services and return part of their responses.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access internal network resources and obtain sensitive information due to server-side request forgery. A protection that blocks requests to inter…
Yüksek 7.5SSRF — Sunucu Taraflı İstek
CVE-2026-19128
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to su…
Yüksek 8.3Uzaktan Kod Çalıştırma (RCE)
CVE-2026-19121
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which…
Kritik 9.4Kimlik Doğrulama / Yetki Atlatma
CVE-2026-18838
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which could allow a caller to impersonate another user.
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not suffi…
Kritik 9.3SSRF — Sunucu Taraflı İstek
CVE-2026-18836
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send reques…
Kritik 9.6Hizmet Reddi (DoS)
CVE-2026-18535
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.
Yüksek 7.6Enjeksiyon (SQL/Komut)
CVE-2026-17411
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not prope…
Kritik 9.9Diğer / Sınıflandırılmamış
CVE-2026-17410
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
Kritik 9.4Bilgi İfşası
CVE-2026-17409
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case s…
Kritik 9.8Enjeksiyon (SQL/Komut)
CVE-2026-17408
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements in an OS command.
Yüksek 8.5Enjeksiyon (SQL/Komut)
CVE-2026-17407
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly neutralized before being used in a database query, which could allow SQL commands to run.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. Values received during sign-in are not properly…
Yüksek 8.5SSRF — Sunucu Taraflı İstek
CVE-2026-17406
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, which could allow the server to reach destinations that should be blocked.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Address checks can be bypassed, whi…
Yüksek 8.8Kimlik Doğrulama / Yetki Atlatma
CVE-2026-17405
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting user is permitted to read them, which could expose keystore information.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore obj…
Yüksek 8.5SSRF — Sunucu Taraflı İstek
CVE-2026-17404
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
Kritik 9Diğer / Sınıflandırılmamış
CVE-2026-17403
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain full administrative control due to the use of hard-coded credentials.
Kritik 9.9Enjeksiyon (SQL/Komut)
CVE-2026-17402
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutralized before it is passed to the operating system, which could allow commands to run on the underlying host.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary commands due to OS command injection. User-supplied input is not properly neutrali…
Yüksek 7.2Uzaktan Kod Çalıştırma (RCE)
CVE-2026-17401
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
Yüksek 7.7Enjeksiyon (SQL/Komut)
CVE-2026-17400
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
Kritik 9.9Uzaktan Kod Çalıştırma (RCE)
CVE-2026-17399
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the product is not sufficiently checked before it is processed, which could allow code to run on the server.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to insufficient validation of uploaded content. Content uploaded to the p…
Yüksek 8.5SSRF — Sunucu Taraflı İstek
CVE-2026-17398
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
Yüksek 8.5SSRF — Sunucu Taraflı İstek
CVE-2026-17397
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
Kritik 9.6Enjeksiyon (SQL/Komut)
CVE-2026-17396
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
Kritik 9.6Bilgi İfşası
CVE-2026-17394
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should be controlled by the system, which could expose sensitive information.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-…
Kritik 9.9Enjeksiyon (SQL/Komut)
CVE-2026-17392
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input is not properly neutralized in directory queries, which could change the query and grant access beyond the user's own tenant.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain unauthorized administrative access to other tenants due to LDAP injection. User-supplied input …
Yüksek 8.5Kimlik Doğrulama / Yetki Atlatma
CVE-2026-17388
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
Yüksek 7.7Kimlik Doğrulama / Yetki Atlatma
CVE-2026-17387
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
Yüksek 8.1Kriptografik Zayıflık
CVE-2026-17386
IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote attacker to gain full administrative control due to the use of a cryptographically weak pseudo-random number generator.
IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote attacker to gain full administrative control due to the use of a cryptographically weak pseudo-random number generator.
Yüksek 8.5SSRF — Sunucu Taraflı İstek
CVE-2026-17385
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
Yüksek 8.5SSRF — Sunucu Taraflı İstek
CVE-2026-17384
IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.
IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.
Yüksek 7.7Kimlik Doğrulama / Yetki Atlatma
CVE-2026-17383
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.
Yüksek 8.5Yol Geçişi / Dosya Erişimi
CVE-2026-17382
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
Yüksek 8.5Kimlik Doğrulama / Yetki Atlatma
CVE-2026-17381
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization validation using user-controlled keys.
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization validation using user-controlled keys.
Kaynaklar: CISA Known Exploited Vulnerabilities (KEV) Catalog · NIST National Vulnerability Database (NVD). Veriler otomatik ve periyodik olarak toplanır; resmi kaynak her zaman önceliklidir.