Product by IBM
App Connect Enterprise Certified Container Operator
35 known vulnerabilities in App Connect Enterprise Certified Container Operator (IBM), 0 of them actively exploited (CISA KEV).
Key figures
35
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
5
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2024-6345 | Remote Code Execution in pypa/setuptools | 8.8 | |
| Critical | CVE-2026-33228 | flatted: Prototype Pollution via parse() | 9.8 | |
| High | CVE-2026-1526 | Undici: Improper Handling of Highly Compressed Data (Data Amplification) | 7.5 | |
| High | CVE-2026-27601 | Underscore.js has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack | 5.9 | |
| High | CVE-2026-26278 | fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) | 7.5 | |
| High | CVE-2026-42033 | Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking | 7.4 | |
| High | CVE-2026-2229 | Undici: Uncaught Exception | 7.5 | |
| High | CVE-2026-42039 | Axios: unbounded recursion in toFormData causes DoS via deeply nested request data | 7.5 | |
| High | CVE-2026-32141 | flatted: Unbounded recursion DoS in parse() revive phase | 7.5 | |
| Critical | CVE-2026-42043 | Axios: Permissive List of Allowed Inputs | 7.2 | |
| Medium | CVE-2025-8885 | Possible DOS in processing specially formed ASN.1 Object Identifiers | — | |
| High | CVE-2026-33036 | Natural Intelligence fast-xml-parser: XML Entity Expansion | 7.5 | |
| High | CVE-2026-27903 | Isaacs Minimatch: Inefficient Algorithmic Complexity | 7.5 | |
| Medium | CVE-2025-8916 | Possible DOS in processing large name constraint structures in PKIXCertPathReveiwer | — | |
| High | CVE-2026-29786 | node-tar: Hardlink Path Traversal via Drive-Relative Linkpath | 6.3 | |
| Critical | CVE-2026-29045 | Hono: Arbitrary file access via serveStatic vulnerability | 7.5 | |
| Critical | CVE-2026-42044 | Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` | 6.5 | |
| High | CVE-2026-27904 | minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions | 7.5 | |
| High | CVE-2026-1528 | Undici: Uncaught Exception | 7.5 | |
| High | CVE-2026-30827 | Express-rate-limit: Allocation of Resources Without Limits or Throttling | 7.5 | |
| Medium | CVE-2026-31988 | yauzl 3.2.0 - Denial of Service via Off-by-One Error in NTFS Timestamp Parser | 5.3 | |
| High | CVE-2026-42035 | Axios: Header Injection via Prototype Pollution | 7.4 | |
| Critical | CVE-2026-1525 | Undici: HTTP Request/Response Smuggling | 6.5 | |
| Medium | CVE-2026-2581 | Undici: Allocation of Resources Without Limits or Throttling | 5.9 | |
| Medium | CVE-2026-42041 | Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy | 4.8 |