Export limit exceeded: 423702 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 423702 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 423702 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 423702 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found ',' (at char 21), (line:1, col:22)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (423702 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-17315 1 Ibm 1 Api Connect 2026-11-07 5.8 Medium
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to improper validation of user-supplied URLs.
CVE-2026-17312 1 Ibm 1 Api Connect 2026-11-07 5.4 Medium
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link the victim's session to an account controlled by the attacker.
CVE-2026-17311 1 Ibm 1 Api Connect 2026-11-07 7.1 High
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify application API subscriptions due to broken object-level authorization.
CVE-2026-17309 1 Ibm 1 Api Connect 2026-11-07 8 High
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and tamper with configuration due to improper certificate validation.
CVE-2026-17214 1 Ibm 1 Api Connect 2026-11-07 4.8 Medium
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass security restrictions due to LDAP injection.
CVE-2026-17187 1 Ibm 1 Api Connect 2026-11-07 8.5 High
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs.
CVE-2026-17172 1 Ibm 1 Api Connect 2026-11-07 8.5 High
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to impersonate another party.
CVE-2026-17158 1 Ibm 1 Api Connect 2026-11-07 9.9 Critical
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain elevated privileges due to improper authentication.
CVE-2026-17155 1 Ibm 1 Api Connect 2026-11-07 5.4 Medium
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to improper neutralization of user-controlled input.
CVE-2026-17154 1 Ibm 1 Api Connect 2026-11-07 5.4 Medium
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform cross-site scripting due to improper neutralization of user-supplied input.
CVE-2026-17146 1 Ibm 1 Api Connect 2026-11-07 9.9 Critical
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary JavaScript and obtain sensitive information due to improper input validation.
CVE-2026-17143 1 Ibm 1 Api Connect 2026-11-07 4.3 Medium
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform HTML injection due to improper neutralization of user-supplied input.
CVE-2026-17140 1 Ibm 1 Api Connect 2026-11-07 3.3 Low
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. Input supplied by a user can influence code generated by the product, which could lead to code execution.
CVE-2026-17134 1 Ibm 1 Api Connect 2026-11-07 9.9 Critical
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection.
CVE-2026-17132 1 Ibm 1 Api Connect 2026-11-07 9.9 Critical
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
CVE-2026-17131 1 Ibm 1 Api Connect 2026-11-07 9.3 Critical
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to contact unintended destinations and return the response.
CVE-2026-17117 1 Ibm 1 Api Connect 2026-11-07 9.9 Critical
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improperly controlled modification of object attributes. A user could set a field that should only be controlled by the system, which could lead to code execution.
CVE-2026-17114 1 Ibm 1 Api Connect 2026-11-07 5.4 Medium
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to the generation of error messages containing sensitive information.
CVE-2026-95860 2026-11-07 9.1 Critical
node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePermissions. SessionContext.getApplicableRolePermissions reads a missing or null DefaultRolePermissions metadata value instead of the configured namespace field, and the null result is treated permissively. An anonymous network client can consequently write variables with CurrentWrite access or call bound methods when an operator configured a restrictive namespace default and relied on inheritance. Servers with no declared policy, nodes with explicit per-node permissions, and correctly bound programmatic namespace metadata are outside the authorization-bypass case. This issue is fixed in version 2.180.0.
CVE-2026-82159 1 Dell 1 Wyse Management Suite 2026-11-07 8.8 High
Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.