EUVD-2026-118795

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which could allow a caller to impersonate another user...

CVE-2026-18838

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are affected by multiple vulnerabilities rooted in improper authentication . Because identity information in requests is not sufficiently verified, a remote attacker could impersonate another user to obtain sensitive information and modify API co...

CVE-2026-17370

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to improper authentication. Due to a flaw in the sign-in flow that fails to sufficiently verify user identity, a remote authenticated attacker could assume another user's identity and obtain their acc...

EUVD-2026-118753

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain an access token for another user due to improper authentication. The sign-in flow does not sufficiently verify the identity of the user completing it, which could allow...

CVE-2026-17326

The software IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 is affected by multiple vulnerabilities. These flaws could allow a remote authenticated attacker to bypass security restrictions due to improper authentication (CWE-287). The CVSS 3.1 score is 8.1 (High...

EUVD-2026-118717

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication...

CVE-2026-17278

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to multiple vulnerabilities caused by improper authentication . Because client-supplied information is not sufficiently verified, a remote attacker could appear as a trusted party to gain unauthorized access to sensitive API catal...

EUVD-2026-118671

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain unauthorized access to sensitive API catalog and runtime configuration data due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to appear as a...

CVE-2026-17172

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected by multiple vulnerabilities that allow a remote authenticated attacker to bypass security restrictions . The root cause is improper authentication where information supplied by the client is not suffici...

EUVD-2026-118650

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to impersonate another...

CVE-2026-17158

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to multiple issues, including CVE-2026-17158 . Specifically, a remote authenticated attacker could gain elevated privileges due to improper authentication (CWE-287). The vulnerability has a CRITICAL C...

EUVD-2026-118648

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to gain elevated privileges due to improper authentication...

CVE-2026-16720

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to multiple security flaws. Specifically, CVE-2026-16720 involves improper authentication where authentication against a connected directory service is not sufficiently enforced, potentially allowing ...

EUVD-2026-118615

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain valid access tokens for other users due to improper authentication. Authentication against a connected directory service is not sufficiently enforced, which could allow another user's...

ColumbiaSoft DocumentLocator - Improper Authentication

Instances of ColumbiaSoft's Document Locator prior to version 7.2 SP4 and 2021.1 are vulnerable to an Improper Authentication/SSRF vulnerability. This template identifies vulnerable instances of the ColumbiaSoft Document Locater application by confirming external DNS interaction/lookups by...

Profile Builder < 3.4.9 - Improper Authentication

The Profile Builder plugin before 3.4.9 for WordPress allows unauthenticated attackers to gain administrative access by exploiting an improper authentication vulnerability in the password reset functionality. An attacker can reset the password of any user, including administrators, without proper...

CirCarLife <4.3 - Improper Authentication

CirCarLife before 4.3 is susceptible to improper authentication. An internal installation path disclosure exists due to the lack of authentication for /html/repository.System. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2018-16668 inf...

CirCarLife <4.3 - Improper Authentication

CirCarLife before 4.3 is susceptible to improper authentication. A system software information disclosure exists due to lack of authentication for /html/device-id. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2018-16671 info: name:...

JFrog Artifactory Access Blank Join Key Authentication Bypass

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges. id: CVE-2026-82329 info: name: JFrog Artifactory Access Blank Join Key Authentication Bypass author: johnk3r,pruv...

ZenML ZenML Server - Improper Authentication

ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/usernameorid/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. id: CVE-2024-25723 info:...