Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

81 records

Priority MEDIUM 49

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00486 Published 2026-10-08 No fix listed CWE-122
Priority LOW 28

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated user to forge signature requests due to improper verificatio…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00135 Published 2026-10-08 No fix listed CWE-345
Priority LOW 24

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00165 Published 2026-10-08 No fix listed CWE-79
Priority LOW 27

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obtain sensitive information due to improper authorizatio…

CVSS 3.1MEDIUM 6.5 Local Low privileges No interaction EPSS 0.00094 Published 2026-10-08 No fix listed CWE-863
Priority MEDIUM 41

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer ove…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00295 Published 2026-10-08 No fix listed CWE-125
Priority LOW 38

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security restrictions due to improp…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00572 Published 2026-10-08 No fix listed CWE-347
Priority MEDIUM 49

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject em…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00397 Published 2026-10-08 No fix listed CWE-287
Priority LOW 33

IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service due to improper memory allocation during key derivation.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00286 Published 2026-10-08 No fix listed CWE-787
Priority LOW 39

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service and obtain sensitive informati…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00267 Published 2026-10-08 No fix listed CWE-416
Priority LOW 26

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to algorithmic complexity…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00265 Published 2026-10-08 No fix listed CWE-400
Priority MEDIUM 43

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overfl…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00381 Published 2026-10-08 No fix listed CWE-122
Priority MEDIUM 42

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00339 Published 2026-10-08 No fix listed CWE-611
TI-2026-69393 CVE-2026-14988 · GHSA-2ffc-9jmm-wqfj

Out-of-bounds read in IBM DataPower Gateway

Priority MEDIUM 42

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to buffer overflow.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00257 Published 2026-10-08 No fix listed CWE-125
Priority LOW 34

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatur…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00186 Published 2026-10-08 No fix listed CWE-347
TI-2026-69396 CVE-2026-14992 · GHSA-3m79-9w2v-h4h8

Out-of-bounds write in IBM DataPower Gateway

Priority MEDIUM 49

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 vulnerable to buffer overflow.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00318 Published 2026-10-08 No fix listed CWE-787
Priority MEDIUM 43

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00417 Published 2026-10-08 No fix listed CWE-787
Priority LOW 37

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to execute arbitrary code due to a buffer ove…

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.00389 Published 2026-10-08 No fix listed CWE-121
Priority LOW 37

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00395 Published 2026-10-08 No fix listed CWE-787
Priority MEDIUM 49

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00527 Published 2026-10-08 No fix listed CWE-787
Priority LOW 39

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to out-of-bounds memory ac…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00327 Published 2026-10-08 No fix listed CWE-787
Priority LOW 39

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper memoization of…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00327 Published 2026-10-08 No fix listed CWE-405
Priority MEDIUM 42

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer ove…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00326 Published 2026-10-08 No fix listed CWE-787
Priority LOW 39

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a type confusion flaw.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00274 Published 2026-10-08 No fix listed CWE-843
Priority MEDIUM 43

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain sensitive information and cause a denial of servi…

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00279 Published 2026-10-08 No fix listed CWE-787
TI-2026-69406 CVE-2026-16161 · GHSA-xg53-qqv9-r75w

Out-of-bounds read in IBM DataPower Gateway

Priority LOW 39

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00313 Published 2026-10-08 No fix listed CWE-125
Load more