# IBM API Connect. Every CVE that names IBM API Connect among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [IBM API Connect SQL Injection](https://agentprime.io/advisories/CVE-2026-9074.md) `CVE-2026-9074` · CVE record: IBM API Connect · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jul 2026 · Tags: SQL injection - [IBM API Connect Default Credentials](https://agentprime.io/advisories/CVE-2026-3144.md) `CVE-2026-3144` · CVE record: IBM API Connect · CVSS 8.1 High · Not analysed yet · Published 8 Jul 2026 · Tags: CWE-1392 - [Authentication bypass in IBM API Connect](https://agentprime.io/advisories/CVE-2025-13915.md) `CVE-2025-13915` · CVE record: IBM API Connect · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Dec 2025 · Tags: CWE-305 - [IBM API Connect information disclosure](https://agentprime.io/advisories/CVE-2023-47722.md) `CVE-2023-47722` · CVE record: IBM API Connect · CVSS 6.2 Medium · Not analysed yet · Published 9 Dec 2023 - [IBM API Connect improper access control](https://agentprime.io/advisories/CVE-2023-28522.md) `CVE-2023-28522` · CVE record: IBM API Connect · CVSS 4.3 Medium · Not analysed yet · Published 12 May 2023 - [IBM API Connect security bypass](https://agentprime.io/advisories/CVE-2022-34350.md) `CVE-2022-34350` · CVE record: IBM API Connect · CVSS 5.3 Medium · Not analysed yet · Published 8 Feb 2023 - [IBM API Connect HOST header injection](https://agentprime.io/advisories/CVE-2021-38997.md) `CVE-2021-38997` · CVE record: IBM API Connect · CVSS 5.4 Medium · Not analysed yet · Published 1 Dec 2022 · Tags: CWE-644 - [IBM API Connect: IBM API Connect 5.0.0.0 through 5.0.8.11 could allow a user to potentially inject code…](https://agentprime.io/advisories/CVE-2021-29772.md) `CVE-2021-29772` · CVE record: IBM API Connect · CVSS 5.6 Medium · Not analysed yet · Published 26 Aug 2021 - [IBM API Connect: IBM API Connect 5.0.0.0 through 5.0.8.11 could alllow a remote user to obtain sensitive…](https://agentprime.io/advisories/CVE-2021-29715.md) `CVE-2021-29715` · CVE record: IBM API Connect · CVSS 6.5 Medium · Not analysed yet · Published 26 Aug 2021 - [IBM API Connect: IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to HTTP header injection…](https://agentprime.io/advisories/CVE-2020-4706.md) `CVE-2020-4706` · CVE record: IBM API Connect · CVSS 5.4 Medium · Not analysed yet · Published 17 Aug 2021 - [IBM API Connect 5.0.0.0 through 5.0.8.11 is vulnerable to cross-site scripting.](https://agentprime.io/advisories/CVE-2020-4707.md) `CVE-2020-4707` · CVE record: IBM API Connect · CVSS 5.4 Medium · Not analysed yet · Published 4 Aug 2021 - [IBM API Connect: IBM API Connect 10.0.0.0, and 2018.4.1.0 through 2018.4.1.13 does not restrict member…](https://agentprime.io/advisories/CVE-2021-20440.md) `CVE-2021-20440` · CVE record: IBM API Connect · CVSS 6.4 Medium · Not analysed yet · Published 15 Mar 2021 - [IBM API Connect: IBM API Connect V10 and V2018 could allow an attacker who has intercepted a registration…](https://agentprime.io/advisories/CVE-2020-4903.md) `CVE-2020-4903` · CVE record: IBM API Connect · CVSS 4.8 Medium · Not analysed yet · Published 8 Mar 2021 - [IBM API Connect V10 is impacted by insecure communications during database replication.](https://agentprime.io/advisories/CVE-2020-4695.md) `CVE-2020-4695` · CVE record: IBM API Connect · CVSS 5.9 Medium · Not analysed yet · Published 8 Mar 2021 - [IBM API Connect: IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is…](https://agentprime.io/advisories/CVE-2020-4828.md) `CVE-2020-4828` · CVE record: IBM API Connect · CVSS 6.5 Medium · Not analysed yet · Published 4 Feb 2021 - [IBM API Connect: IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is…](https://agentprime.io/advisories/CVE-2020-4827.md) `CVE-2020-4827` · CVE record: IBM API Connect · CVSS 4.3 Medium · Not analysed yet · Published 4 Feb 2021 - [IBM API Connect: IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is…](https://agentprime.io/advisories/CVE-2020-4826.md) `CVE-2020-4826` · CVE record: IBM API Connect · CVSS 4.3 Medium · Not analysed yet · Published 4 Feb 2021 - [IBM API Connect: IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13 is…](https://agentprime.io/advisories/CVE-2020-4825.md) `CVE-2020-4825` · CVE record: IBM API Connect · CVSS 5.4 Medium · Not analysed yet · Published 4 Feb 2021 - [IBM API Connect: Certain IBM API Connect 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.13…](https://agentprime.io/advisories/CVE-2020-4640.md) `CVE-2020-4640` · CVE record: IBM API Connect · CVSS 3.4 Low · Not analysed yet · Published 4 Feb 2021 - [IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to stored cross-site scripting.](https://agentprime.io/advisories/CVE-2020-4838.md) `CVE-2020-4838` · CVE record: IBM API Connect · CVSS 6.4 Medium · Not analysed yet · Published 12 Jan 2021 - [IBM API Connect: IBM API Connect 5.0.0.0 through 5.0.8.10 could potentially leak sensitive information or…](https://agentprime.io/advisories/CVE-2020-4899.md) `CVE-2020-4899` · CVE record: IBM API Connect · CVSS 7.4 High · Not analysed yet · Published 5 Jan 2021 - [IBM API Connect's API Manager 2018.4.1.0 through 2018.4.1.12 is vulnerable to privilege escalation.](https://agentprime.io/advisories/CVE-2020-4638.md) `CVE-2020-4638` · CVE record: IBM API Connect · CVSS 7.2 High · Not analysed yet · Published 3 Sept 2020 - [IBM API Connect: IBM API Connect 2018.4.1.0 through 2018.4.1.12 could allow an attacker to launch phishing…](https://agentprime.io/advisories/CVE-2020-4337.md) `CVE-2020-4337` · CVE record: IBM API Connect · CVSS 6.5 Medium · Not analysed yet · Published 3 Sept 2020 - [IBM API Connect: IBM API Connect V2018.4.1.0 through 2018.4.1.11 uses weaker than expected cryptographic…](https://agentprime.io/advisories/CVE-2020-4452.md) `CVE-2020-4452` · CVE record: IBM API Connect · CVSS 5.9 Medium · Not analysed yet · Published 29 Jun 2020 - [IBM API Connect 5.0.0.0 through 5.0.8.8 is vulnerable to cross-site scripting.](https://agentprime.io/advisories/CVE-2020-4251.md) `CVE-2020-4251` · CVE record: IBM API Connect · CVSS 5.4 Medium · Not analysed yet · Published 12 Jun 2020 - [IBM API Connect: IBM API Connect's V2018.4.1.0 through 2018.4.1.10 management server has an unsecured api…](https://agentprime.io/advisories/CVE-2020-4346.md) `CVE-2020-4346` · CVE record: IBM API Connect · CVSS 5.3 Medium · Not analysed yet · Published 12 May 2020 - [IBM API Connect: IBM API Connect V2018.4.1.0 through 2018.4.1.10 could allow a remote attacker to hijack…](https://agentprime.io/advisories/CVE-2020-4195.md) `CVE-2020-4195` · CVE record: IBM API Connect · CVSS 5.4 Medium · Not analysed yet · Published 12 May 2020 - [IBM API Connect: IBM API Connect V5.0.0.0 through 5.0.8.7iFix3 uses weaker than expected cryptographic…](https://agentprime.io/advisories/CVE-2019-4553.md) `CVE-2019-4553` · CVE record: IBM API Connect · CVSS 5.9 Medium · Not analysed yet · Published 24 Mar 2020 - [IBM API Connect: IBM API Connect 2018.4.1.7 uses weaker than expected cryptographic algorithms that could…](https://agentprime.io/advisories/CVE-2019-4609.md) `CVE-2019-4609` · CVE record: IBM API Connect · CVSS 5.9 Medium · Not analysed yet · Published 18 Dec 2019 - [IBM API Connect: IBM API Connect 2018.1 through 2018.4.1.7 Developer Portal's user registration page does…](https://agentprime.io/advisories/CVE-2019-4444.md) `CVE-2019-4444` · CVE record: IBM API Connect · CVSS 5.1 Medium · Not analysed yet · Published 16 Dec 2019 - [IBM API Connect: IBM API Connect version V5.0.0.0 through 5.0.8.7 could reveal sensitive information to an…](https://agentprime.io/advisories/CVE-2019-4600.md) `CVE-2019-4600` · CVE record: IBM API Connect · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2019 - [IBM API Connect: IBM API Connect 2018.1 through 2018.4.1.6 may inadvertently leak sensitive details about…](https://agentprime.io/advisories/CVE-2019-4437.md) `CVE-2019-4437` · CVE record: IBM API Connect · CVSS 8.2 High · Not analysed yet · Published 20 Aug 2019 - [IBM API Connect: IBM API Connect 5.0.0.0 through 5.0.8.6 developer portal could allow a remote attacker to…](https://agentprime.io/advisories/CVE-2019-4460.md) `CVE-2019-4460` · CVE record: IBM API Connect · CVSS 4.3 Medium · Not analysed yet · Published 20 Aug 2019 - [IBM API Connect: IBM API Connect 2018.1 through 2018.4.1.6 developer portal could allow an unauthorized…](https://agentprime.io/advisories/CVE-2019-4402.md) `CVE-2019-4402` · CVE record: IBM API Connect · CVSS 8.6 High · Not analysed yet · Published 20 Aug 2019 - [IBM API Connect: IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain…](https://agentprime.io/advisories/CVE-2019-4382.md) `CVE-2019-4382` · CVE record: IBM API Connect · CVSS 5.3 Medium · Not analysed yet · Published 25 Jun 2019 - [IBM API Connect: IBM API Connect 2018.1 through 2018.4.1.5 could disclose sensitive information to an…](https://agentprime.io/advisories/CVE-2018-2013.md) `CVE-2018-2013` · CVE record: IBM API Connect · CVSS 5.3 Medium · Not analysed yet · Published 25 Jun 2019 - [IBM API Connect: IBM API Connect 2018.1 through 2018.4.1.5 could allow an attacker to obtain sensitive…](https://agentprime.io/advisories/CVE-2018-2011.md) `CVE-2018-2011` · CVE record: IBM API Connect · CVSS 5.3 Medium · Not analysed yet · Published 25 Jun 2019 - [IBM API Connect: IBM API Connect 5.0.0.0 through 5.0.8.6 is vulnerable to cross-site request forgery which…](https://agentprime.io/advisories/CVE-2018-1858.md) `CVE-2018-1858` · CVE record: IBM API Connect · CVSS 4.3 Medium · Not analysed yet · Published 25 Jun 2019 - [IBM API Connect: IBM API Connect 5.0.0.0 through 5.0.8.6 uses weaker than expected cryptographic…](https://agentprime.io/advisories/CVE-2019-4256.md) `CVE-2019-4256` · CVE record: IBM API Connect · CVSS 5.9 Medium · Not analysed yet · Published 29 May 2019 - [IBM API Connect: IBM API Connect 5.0.0.0, and 5.0.8.6 could could return sensitive information that could…](https://agentprime.io/advisories/CVE-2018-1991.md) `CVE-2018-1991` · CVE record: IBM API Connect · CVSS 2.7 Low · Not analysed yet · Published 22 May 2019 - [IBM API Connect: IBM API Connect 2018.1 and 2018.4.1.4 could allow a remote attacker to hijack the…](https://agentprime.io/advisories/CVE-2018-2015.md) `CVE-2018-2015` · CVE record: IBM API Connect · CVSS 6.4 Medium · Not analysed yet · Published 2 May 2019 - [IBM API Connect: IBM API Connect 2018.1 and 2018.4.1.2 uses weaker than expected cryptographic algorithms…](https://agentprime.io/advisories/CVE-2018-2007.md) `CVE-2018-2007` · CVE record: IBM API Connect · CVSS 5.9 Medium · Not analysed yet · Published 29 Apr 2019 - [IBM API Connect: IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal can be exploited by app developers…](https://agentprime.io/advisories/CVE-2019-4203.md) `CVE-2019-4203` · CVE record: IBM API Connect · CVSS 8.9 High · Not analysed yet · Published 15 Apr 2019 - [IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection.](https://agentprime.io/advisories/CVE-2019-4202.md) `CVE-2019-4202` · CVE record: IBM API Connect · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Apr 2019 - [IBM API Connect: IBM API Connect's Developer Portal 2018.1 and 2018.4.1.3 is impacted by a privilege…](https://agentprime.io/advisories/CVE-2019-4155.md) `CVE-2019-4155` · CVE record: IBM API Connect · CVSS 8.8 High · Not analysed yet · Published 8 Apr 2019 - [IBM API Connect: Some URIs in IBM API Connect 2018.1 and 2018.4.1.3 disclose system specification…](https://agentprime.io/advisories/CVE-2019-4051.md) `CVE-2019-4051` · CVE record: IBM API Connect · CVSS 5.3 Medium · Not analysed yet · Published 8 Apr 2019 - [IBM API Connect: IBM API Connect 5.0.0.0 through 5.0.8.5 could display highly sensitive information to an…](https://agentprime.io/advisories/CVE-2018-1874.md) `CVE-2018-1874` · CVE record: IBM API Connect · CVSS 4.6 Medium · Not analysed yet · Published 2 Apr 2019 - [IBM API Connect: IBM API Connect 2018.1 and 2018.4.1.2 apis can be leveraged by unauthenticated users to…](https://agentprime.io/advisories/CVE-2019-4052.md) `CVE-2019-4052` · CVE record: IBM API Connect · CVSS 8.2 High · Not analysed yet · Published 22 Mar 2019 - [IBM API Connect: IBM API Connect v2018.1 and 2018.4.1 is affected by an information disclosure…](https://agentprime.io/advisories/CVE-2018-2009.md) `CVE-2018-2009` · CVE record: IBM API Connect · CVSS 6.5 Medium · Not analysed yet · Published 11 Mar 2019 - [API Connect V2018.1 through 2018.4.1.1 is impacted by access token leak.](https://agentprime.io/advisories/CVE-2019-4008.md) `CVE-2019-4008` · CVE record: IBM API Connect · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Feb 2019 - [IBM API Connect: IBM API Connect 5.0.0.0 through 5.0.8.4 is impacted by sensitive information disclosure…](https://agentprime.io/advisories/CVE-2018-1976.md) `CVE-2018-1976` · CVE record: IBM API Connect · CVSS 4.9 Medium · Not analysed yet · Published 29 Jan 2019 - [IBM API Connect: IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based…](https://agentprime.io/advisories/CVE-2018-1932.md) `CVE-2018-1932` · CVE record: IBM API Connect · CVSS 4.9 Medium · Not analysed yet · Published 8 Jan 2019 - [IBM API Connect: IBM API Connect 5.0.0.0 through 5.0.8.4 could allow a user authenticated as an…](https://agentprime.io/advisories/CVE-2018-1859.md) `CVE-2018-1859` · CVE record: IBM API Connect · CVSS 4.3 Medium · Not analysed yet · Published 4 Jan 2019 - [IBM API Connect: IBM API Connect 5.0.0.0 through 5.0.8.4 allows a user with limited 'API Administrator…](https://agentprime.io/advisories/CVE-2018-1973.md) `CVE-2018-1973` · CVE record: IBM API Connect · CVSS 7.2 High · Not analysed yet · Published 20 Dec 2018 - [IBM API Connect: IBM API Connect 5.0.0.0 and 5.0.8.4 is affected by a NoSQL Injection in MongoDB connector…](https://agentprime.io/advisories/CVE-2018-1784.md) `CVE-2018-1784` · CVE record: IBM API Connect · CVSS 7.1 High · Not analysed yet · Published 20 Dec 2018 - [IBM API Connect: IBM LoopBack (IBM API Connect 2018.1, 2018.4.1, 5.0.8.0…](https://agentprime.io/advisories/CVE-2018-1778.md) `CVE-2018-1778` · CVE record: IBM API Connect · CVSS 7.7 High · Not analysed yet · Published 20 Dec 2018 - [IBM API Connect: IBM API Connect 2018.1 through 2018.3.7 could allow an unauthenticated attacker to cause…](https://agentprime.io/advisories/CVE-2018-1779.md) `CVE-2018-1779` · CVE record: IBM API Connect · CVSS 7.5 High · Not analysed yet · Published 20 Nov 2018 - [IBM API Connect: IBM API Connect 5.0.0.0, 5.0.8.4, 2018.1 and 2018.3.6 is vulnerable to CSV injection via…](https://agentprime.io/advisories/CVE-2018-1774.md) `CVE-2018-1774` · CVE record: IBM API Connect · CVSS 8.9 High · Not analysed yet · Published 9 Nov 2018 - [IBM API Connect: IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially…](https://agentprime.io/advisories/CVE-2018-1789.md) `CVE-2018-1789` · CVE record: IBM API Connect · CVSS 8.4 High · Not analysed yet · Published 7 Sept 2018 - [IBM API Connect: IBM API Connect 5.0.0.0 through 5.0.8.3 could allow a remote attacker to hijack the…](https://agentprime.io/advisories/CVE-2018-1599.md) `CVE-2018-1599` · CVE record: IBM API Connect · CVSS 5.4 Medium · Not analysed yet · Published 22 Aug 2018 Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .