Login Request a demo
AC
Product
API Connect
by IBM · last CVE Jul 8, 2026
81
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities81In the news0Timeline
Severity mix
Critical 14High 22Medium 44Low 1
Severity
All severities81Critical14High22Medium44Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add API Connect to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-4707
5.4
0%
Aug 4
IBM API Connect 5.0.0.0 through 5.0.8.11 is vulnerable to cross-site scripting
Affected: 5.0.0.0 through 5.0.8.11
CVE-2020-4825
5.4
1%
Feb 4
IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site scripting
Affected: 2018.4.1.0 through 2018.4.1.13; 10.0.0.0; 10.0.1.0
CVE-2020-4838
5.4
1%
Jan 12
IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to stored cross-site scripting
Affected: 5.0.0.0 through 5.0.8.10
CVE-2020-4251
5.4
1%
Jun 12
IBM API Connect 5.0.0.0 through 5.0.8.8 is vulnerable to cross-site scripting
Affected: 5.0.0.0 through 5.0.8.8
CVE-2020-4195
5.4
1%
May 12
IBM API Connect V2018.4.1.0 through 2018.4.1.10 could allow a remote attacker to hijack the clicking action of the victim
Affected: 2018.4.1.0 through 2018.4.1.10
CVE-2018-1599
5.4
1%
Aug 22
IBM API Connect 5.0.0.0 through 5.0.8.3 could allow a remote attacker to hijack the clicking action of the victim
Affected: 5.0.1.0; 5.0.0.0; 5.0.2.0; 5.0.5.0; 5.0.6.0; 5.0.6.1; +14 more
CVE-2018-1430
5.4
1%
Apr 30
IBM API Connect 5.0.0.0 through 5.0.8.2 is vulnerable to cross-site scripting
Affected: 5.0.0.0 through 5.0.8.2
CVE-2018-1382
5.4
1%
Feb 7
IBM API Connect 5.0.0.0 is vulnerable to cross-site scripting
Affected: 5.0.0.0 through 5.0.6.4; 5.0.7.0; 5.0.7.1; 5.0.7.2; 5.0.8.0; 5.0.8.1
CVE-2020-4346
5.3
1%
May 12
IBM API Connect's V2018.4.1.0 through 2018.4.1.10 management server has an unsecured api which can be exploited by an unauthenticated attacker to obtain sensitive information
Affected: 2018.4.1.0 through 2018.4.1.10
CVE-2019-4600
5.3
1%
Oct 29
IBM API Connect version V5.0.0.0 through 5.0.8.7 could reveal sensitive information to an attacker using a specially crafted HTTP request
Affected: 5.0.0.0 through 5.0.8.7
CVE-2019-4437
5.3
1%
Aug 20
IBM API Connect 2018.1 through 2018.4.1.6 may inadvertently leak sensitive details about internal servers and network via API swagger
Affected: 2018.1.0 through 2018.4.1.6
CVE-2019-4382
5.3
8%
Jun 25
IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specially crafted HTTP requests
Affected: 5.0.0.0 through 5.0.8.6
CVE-2018-2013
5.3
2%
Jun 25
IBM API Connect 2018.1 through 2018.4.1.5 could disclose sensitive information to an unauthorized user that could aid in further attacks against the system
Affected: 2018.1.0 through 2018.4.1.5
CVE-2018-2011
5.3
3%
Jun 25
IBM API Connect 2018.1 through 2018.4.1.5 could allow an attacker to obtain sensitive information from a specially crafted HTTP request that could aid an attacker in further…
Affected: 2018.1.0 through 2018.4.1.5
CVE-2019-4051
5.3
2%
Apr 8
Some URIs in IBM API Connect 2018.1 and 2018.4.1.3 disclose system specification information like the machine id, system uuid, filesystem paths, network interface names along with…
Affected: 2018.1.0 through 2018.4.1.3
CVE-2016-1000232
5.3
2%
Sep 5
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service
Affected: 5.0.6.0 through 5.0.6.5; 5.0.7.0 through 5.0.7.2; 5.0.8.0
CVE-2017-1328
5.3
2%
Jun 27
IBM API Connect 5.0.0.0 - 5.0.6.0 could allow a remote attacker to bypass security restrictions of the api, caused by improper handling of security policy
Affected: 5.0.0.0; 5.0.0.1; 5.0.1.0; 5.0.2.0; 5.0.3.0; 5.0.4.0; +4 more
CVE-2018-1976
4.9
2%
Jan 29
IBM API Connect 5.0.0.0 through 5.0.8.4 is impacted by sensitive information disclosure via a REST API that could allow a user with administrative privileges to obtain highly…
Affected: 5.0.0.0; 5.0.8.4
CVE-2018-1932
4.9
3%
Jan 8
IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the management server that could allow an authenticated user to obtain…
Affected: 5.0.0.0 through 5.0.8.4
CVE-2018-1859
4.7
1%
Jan 4
IBM API Connect 5.0.0.0 through 5.0.8.4 could allow a user authenticated as an administrator with limited rights to escalate their privileges
Affected: 5.0.0.0 through 5.0.8.4
CVE-2018-1874
4.6
0%
Apr 2
IBM API Connect 5.0.0.0 through 5.0.8.5 could display highly sensitive information to an attacker with physical access to the system
Affected: 5.0.0.0 through 5.0.8.5
CVE-2021-20440
4.3
1%
Mar 15
IBM API Connect 10.0.0.0, and 2018.4.1.0 through 2018.4.1.13 does not restrict member registration to the intended recepient
Affected: 2018.4.1.0 through 2018.4.1.13; 10.0.0.0
CVE-2020-4827
4.3
0%
Feb 4
IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and…
Affected: 2018.4.1.0 through 2018.4.1.13; 10.0.0.0; 10.0.1.0
CVE-2020-4826
4.3
0%
Feb 4
IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and…
Affected: 2018.4.1.0 through 2018.4.1.13; 10.0.0.0; 10.0.1.0
CVE-2018-1548
4.3
1%
Jul 9
IBM API Connect 2018.1.0.0, 2018.2.1, 2018.2.2, 2018.2.3, and 2018.2.4 contains a vulnerability that could allow an authenticated user to obtain sensitive information
Affected: 2018.1.0.0 through 2018.2.4
CVE-2018-1532
4.3
1%
May 31
IBM API Connect 5.0.0.0 through 5.0.8.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks against the system
Affected: 5.0.0.0 through 5.0.8.2
CVE-2018-1468
4.3
1%
May 2
IBM API Connect 5.0.8.1 and 5.0.8.2 could allow a user to get access to internal environment and sensitive API details to which they are not authorized
Affected: 5.0.8.1; 5.0.8.2
CVE-2017-1785
4.3
1%
Feb 7
IBM API Connect 5.0.7 and 5.0.8 could allow an authenticated remote user to modify query parameters to obtain sensitive information
Affected: 5.0.7.0; 5.0.7.1; 5.0.7.2; 5.0.8.0; 5.0.8.1
CVE-2017-1555
4.3
1%
Sep 25
IBM API Connect 5.0.0.0 through 5.0.7.2 could allow an authenticated user to generate an API token when not subscribed to the application plan
Affected: 5.0.0.0; 5.0.0.1; 5.0.1.0; 5.0.2.0; 5.0.3.0; 5.0.4.0; +9 more
CVE-2020-4640
4.1
0%
Feb 4
Certain IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 configurations can result in sensitive information in the URL fragment identifiers
Affected: 2018.4.1.0 through 2018.4.1.13; 10.0.0.0; 10.0.1.0
CVE-2018-1991
2.7
1%
May 22
IBM API Connect 5.0.0.0, and 5.0.8.6 could could return sensitive information that could provide critical information as to the underlying software stack in CMC UI headers
Affected: 5.0.0.0 through 5.0.8.6
Page 2 of 2 · 81 total
12