Product by IBM
App Connect Enterprise Certified Container
34 known vulnerabilities in App Connect Enterprise Certified Container (IBM), 0 of them actively exploited (CISA KEV).
Key figures
34
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
6
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-4800 | lodash vulnerable to Code Injection via `_.template` imports key names | 8.1 | |
| Critical | CVE-2026-33937 | Handlebars.js has JavaScript Injection via AST Type Confusion | 9.8 | |
| High | CVE-2021-23337 | Command Injection | 7.2 | |
| Critical | CVE-2026-41242 | protobufjs has an arbitrary code execution issue | 9.8 | |
| Critical | CVE-2026-39892 | cryptography has a buffer overflow if non-contiguous buffers were passed to APIs | 9.8 | |
| High | CVE-2026-33938 | Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block | 8.1 | |
| High | CVE-2026-33940 | Handlebars-lang Handlebars.js: Code Injection | 8.1 | |
| Critical | CVE-2026-42264 | Axios: Prototype Pollution | 7.4 | |
| High | CVE-2026-33939 | Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation | 7.5 | |
| High | CVE-2024-51465 | IBM App Connect Enterprise Certified Container command execution | 8.8 | |
| High | CVE-2026-27141 | Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net | 7.5 | |
| High | CVE-2026-40895 | follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets | 7.5 | |
| High | CVE-2026-33750 | brace-expansion: Zero-step sequence causes process hang and memory exhaustion | 7.5 | |
| Medium | CVE-2022-22404 | IBM App Connect Enterprise Certified Container: Denial of Service | 6.5 | |
| High | CVE-2026-33941 | Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options | 8.2 | |
| Medium | CVE-2022-42439 | IBM App Connect Enterprise information disclosure | 6.8 | |
| Medium | CVE-2022-31770 | IBM App Connect Enterprise Certified Container: Denial of Service | 4.9 | |
| Medium | CVE-2026-41650 | fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters | 6.1 | |
| Medium | CVE-2026-40186 | ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements | 6.1 | |
| High | CVE-2022-43915 | IBM App Connect Enterprise Certified Container | 6.8 | |
| Medium | CVE-2020-4785 | IBM App Connect Enterprise Certified Container: security vulnerability | 5.4 | |
| Medium | CVE-2026-41305 | PostCSS has XSS via Unescaped </style> in its CSS Stringify Output | 6.1 | |
| Medium | CVE-2026-40087 | LangChain has incomplete f-string validation in prompt templates | 5.3 | |
| Critical | CVE-2022-43916 | IBM App Connect Enterprise Certified Container improper communications restriction | 6.8 | |
| Medium | CVE-2026-34073 | cryptography has incomplete DNS name constraint enforcement on peer names | 5.3 |