medium · CVSS v3 4.3

CVE-2026-17211

IBM API Connect versions 10.0.8.0‑10.0.8.12 and 12.1.0.0‑12.1.1.2 are vulnerable to a remote authenticated denial‑of‑service attack caused b

Overview

IBM API Connect versions 10.0.8.0‑10.0.8.12 and 12.1.0.0‑12.1.1.2 are vulnerable to a remote authenticated denial‑of‑service attack caused by incorrect type conversion. An attacker can trigger invalid responses or service unavailability. The issue affects API management deployments that rely on these versions.

Description

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to cause a denial of service due to incorrect type conversion. A value is converted incorrectly between two different types, which could cause the service to return invalid responses or become unavailable.

Impact

The vulnerability compromises availability, potentially disrupting API traffic and service uptime. It is exploitable only by users with valid authentication, so administrators and privileged users are the primary risk group. The impact is limited to the affected API Connect instances and their downstream consumers.

Remediation

Apply the latest IBM security patch for API Connect (e.g., upgrade to 10.0.8.13 or 12.1.1.3, whichever is applicable). If upgrading is not immediately possible, restrict authenticated access to the API Connect management console, monitor for abnormal request patterns, and temporarily disable exposed APIs until a patch is applied.

Risk context

The CVSS v3 score of 4.3 indicates a medium severity risk. With no EPSS data, the urgency is moderate; defenders should prioritize patching or mitigation in line with their patch management cycle.

Affected products

  • IBM API Connect 10.0.8.0‑10.0.8.12
  • IBM API Connect 12.1.0.0‑12.1.1.2

Scores

Severity
medium
CVSS v2
4
CVSS v3
4.3
CVSS v4
—
EPSS
—

denial-of-service IBM API Connect authenticated type-conversion medium availability

← All CVEs

Related CVEs

medium

CVE-2026-118528

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX action, allowing authenticated attackers with Subscriber-level access and above to disclose another user's private and unpublished draft listing details, including contact information.

View analysis

medium

CVE-2026-118204

The WP Data Access – App Builder plugin for WordPress is vulnerable to stored XSS via the ImageURL column value. Authenticated users with subscriber-level access can inject scripts that run when others view the page. This flaw allows malicious code to execute in the context of site visitors.

View analysis

medium

CVE-2026-121792

The GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI plugin for WordPress is vulnerable to generic SQL Injection via the 'input_ . (Gravity Forms name-field part, or list-field row)' parameter in all versions up to, and including, 8.1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a GamiPress achievement already configured against a Gravity Forms 'field value submission' event with the corresponding form published — a standard setup for sites using the integration.

View analysis

medium

CVE-2026-93902

The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via Social Profile Fields in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is scoped to the attacker's own user meta but is exposed publicly on their author archive page at /author/ /, which is accessible to unauthenticated visitors regardless of whether the attacker has published any posts.

View analysis