Total
81 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-7366 | 1 Ibm | 1 Datapower Gateway | 2026-10-24 | N/A | 4.2 MEDIUM |
| IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent request processing, X‑Client‑IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients’ IP addresses. | |||||
| CVE-2026-14905 | 1 Ibm | 1 Datapower Gateway | 2026-10-15 | N/A | 8.2 HIGH |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. | |||||
| CVE-2026-14521 | 1 Ibm | 1 Datapower Gateway | 2026-10-15 | N/A | 4.9 MEDIUM |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. | |||||
| CVE-2026-16169 | 1 Ibm | 1 Datapower Gateway | 2026-10-15 | N/A | 7.5 HIGH |
| IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. | |||||
| CVE-2026-16170 | 1 Ibm | 1 Datapower Gateway | 2026-10-15 | N/A | 7.5 HIGH |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap buffer overflow. | |||||
| CVE-2026-16176 | 1 Ibm | 1 Datapower Gateway | 2026-10-15 | N/A | 7.5 HIGH |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper validation of the length field during memory reallocation. | |||||
| CVE-2026-16177 | 1 Ibm | 1 Datapower Gateway | 2026-10-15 | N/A | 5.3 MEDIUM |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read. | |||||
| CVE-2026-16178 | 1 Ibm | 1 Datapower Gateway | 2026-10-15 | N/A | 7.5 HIGH |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper input validation. | |||||
| CVE-2026-16179 | 1 Ibm | 1 Datapower Gateway | 2026-10-15 | N/A | 7.5 HIGH |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a heap buffer underwrite and potentially crash the service. | |||||
| CVE-2026-16181 | 1 Ibm | 1 Datapower Gateway | 2026-10-15 | N/A | 7.4 HIGH |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass security restrictions due to improper authorization. | |||||
| CVE-2026-16182 | 1 Ibm | 1 Datapower Gateway | 2026-10-15 | N/A | 5.9 MEDIUM |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a NULL pointer dereference in GraphQL variable processing. | |||||
| CVE-2026-16340 | 1 Ibm | 1 Datapower Gateway | 2026-10-15 | N/A | 9.8 CRITICAL |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write in the RFC2047 encoded-word parser. | |||||
| CVE-2026-14991 | 1 Ibm | 1 Datapower Gateway | 2026-10-15 | N/A | 9.8 CRITICAL |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system. | |||||
| CVE-2026-15762 | 1 Ibm | 1 Datapower Gateway | 2026-10-15 | N/A | 9.8 CRITICAL |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write. | |||||
| CVE-2026-15781 | 1 Ibm | 1 Datapower Gateway | 2026-10-15 | N/A | 8.0 HIGH |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow. | |||||
| CVE-2026-15784 | 1 Ibm | 1 Datapower Gateway | 2026-10-15 | N/A | 8.1 HIGH |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write. | |||||
| CVE-2026-15819 | 1 Ibm | 1 Datapower Gateway | 2026-10-15 | N/A | 7.5 HIGH |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to out-of-bounds memory access caused by a strict-weak-ordering violation in a sorting comparator. | |||||
| CVE-2026-15822 | 1 Ibm | 1 Datapower Gateway | 2026-10-15 | N/A | 7.5 HIGH |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper memoization of GraphQL fragment spreads. | |||||
| CVE-2026-15824 | 1 Ibm | 1 Datapower Gateway | 2026-10-15 | N/A | 8.2 HIGH |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow. | |||||
| CVE-2026-16111 | 1 Ibm | 1 Datapower Gateway | 2026-10-15 | N/A | 7.5 HIGH |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a type confusion flaw. | |||||