Security Vulnerabilities
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to overwrite arbitrary files due to a path traversal vulnerability.
CVSS Score
7.5
EPSS Score
0.005
Published
2026-11-07
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.
CVSS Score
7.7
EPSS Score
0.004
Published
2026-11-07
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions to access and modify sensitive information due to improper restriction of security token assignment.
CVSS Score
8.8
EPSS Score
0.006
Published
2026-11-07
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to view arbitrary files on the system due to a path traversal vulnerability. A specially crafted URL request could allow directories outside the intended location to be accessed.
CVSS Score
4.3
EPSS Score
0.004
Published
2026-11-07
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript in the victim's browser due to cross-site scripting. User-supplied input is not properly neutralized when a web page is updated, so script content could run in another user's session.
CVSS Score
8.7
EPSS Score
0.004
Published
2026-11-07
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an attacker to gain unauthorized access to an organization due to improper verification of a cryptographic signature. A token is accepted without its signature being fully verified, which could allow an attacker to join an organization without a valid invitation.
CVSS Score
6.8
EPSS Score
0.002
Published
2026-11-07
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a token to be accepted that should be rejected due to an improperly implemented security check. Under certain conditions, token validation is incomplete, so a token may be accepted for a purpose it was not intended for.
CVSS Score
4.2
EPSS Score
0.002
Published
2026-11-07
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow arbitrary code to be executed by the management service in certain non-default configurations due to improper control of generation of code. Customization content may be evaluated as code, which is only possible where the related feature is enabled and not properly restricted.
CVSS Score
7.5
EPSS Score
0.003
Published
2026-11-07
CVE-2026-123218
IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.
Known exploited
CVSS Score
9.8
EPSS Score
0.007
Published
2026-11-07
CVE-2026-19868
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
Known exploited
CVSS Score
7.5
EPSS Score
0.006
Published
2026-11-06