Security Vulnerabilities
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a token to be accepted that should be rejected due to an improperly implemented security check. Under certain conditions, token validation is incomplete, so a token may be accepted for a purpose it was not intended for.
CVSS Score
4.2
EPSS Score
0.002
Published
2026-11-07
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow arbitrary code to be executed by the management service in certain non-default configurations due to improper control of generation of code. Customization content may be evaluated as code, which is only possible where the related feature is enabled and not properly restricted.
CVSS Score
7.5
EPSS Score
0.003
Published
2026-11-07
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to create, modify, or delete tenants due to missing authorization.
CVSS Score
9.8
EPSS Score
0.006
Published
2026-11-07
CVE-2026-123218
IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.
Known exploited
CVSS Score
9.8
EPSS Score
0.005
Published
2026-11-07
CVE-2026-19868
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
Known exploited
CVSS Score
7.5
EPSS Score
0.005
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories
CVSS Score
5.3
EPSS Score
0.003
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects
CVSS Score
3.3
EPSS Score
0.002
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation
CVSS Score
4.3
EPSS Score
0.003
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion
CVSS Score
5.3
EPSS Score
0.001
Published
2026-11-06
In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates
CVSS Score
7.4
EPSS Score
0.002
Published
2026-11-06