CVE-2026-9074

CriticalCVSS 9.8/10Last modified Jul 10, 2026

Description

IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2026
Last modified: Jul 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-90767.5Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stre CVE-2026-907676.5Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arb CVE-2026-907688.1CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analys CVE-2026-907697.7Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform serve CVE-2026-90778.5IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitra CVE-2026-907708.8Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor address CVE-2026-907713.7joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __prot CVE-2026-907727.6Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in CVE-2026-907733.2procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attack CVE-2026-907747.5rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypa CVE-2026-907756.5PostGIS address_standardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an ar CVE-2026-907767.5Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email