Advisories · Technology

IBM DataPower Gateway 10.6.0.

Every CVE that names IBM DataPower Gateway 10.6.0 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-14269 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

IBM DataPower Gateway Buffer Overflow
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-13257 CVE record

CVSS 6.5 Medium

IBM DataPower Gateway Insufficient Verification of Data Authenticity
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- CWE-345
Not analysed yet 8 Oct 2026
CVE-2026-13258 CVE record

CVSS 5.4 Medium

IBM DataPower Gateway Cross-Site Scripting
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Cross-site scripting (XSS)
Not analysed yet 8 Oct 2026
CVE-2026-14273 CVE record

CVSS 6.5 Medium

IBM DataPower Gateway Incorrect Authorization
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Broken access control
Not analysed yet 8 Oct 2026
CVE-2026-14496 CVE record

CVSS 8.2 High

IBM DataPower Gateway Out-of-bounds Read
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-14497 CVE record

CVSS 8.1 High

IBM DataPower Gateway Improper Verification of Cryptographic Signature
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Weak cryptography or TLS
Not analysed yet 8 Oct 2026
CVE-2026-14502 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

IBM DataPower Gateway Improper Authentication
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Authentication bypass
Not analysed yet 8 Oct 2026
CVE-2026-14508 CVE record

CVSS 6.5 Medium

IBM DataPower Gateway Use After Free
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-14509 CVE record

CVSS 5.9 Medium

IBM DataPower Gateway Denial of Service
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Denial of service
Not analysed yet 8 Oct 2026
CVE-2026-14888 CVE record

CVSS 8.1 High

IBM DataPower Gateway Buffer Overflow
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-14905 CVE record

CVSS 8.2 High

IBM DataPower Gateway XXE
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- XML external entities (XXE)
Not analysed yet 8 Oct 2026
CVE-2026-14988 CVE record

CVSS 6.5 Medium

IBM DataPower Gateway Out-of-bounds Read
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-14999 CVE record

CVSS 7.4 High

IBM DataPower Gateway Improper Verification of Cryptographic Signature
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Weak cryptography or TLS
Not analysed yet 8 Oct 2026
CVE-2026-14992 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

IBM DataPower Gateway Out-of-bounds Write
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-14990 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

IBM DataPower Gateway affected by cross-site scripting
- IBM DataPower Gateway 10.6.0
- Cross-site scripting (XSS)
Not analysed yet 8 Oct 2026
CVE-2026-14991 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

IBM DataPower Gateway Out-of-bounds Write
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-15781 CVE record

CVSS 8.0 High

IBM DataPower Gateway Buffer Overflow
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-15784 CVE record

CVSS 8.1 High

IBM DataPower Gateway Out-of-bounds Write
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-15762 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

IBM DataPower Gateway Out-of-bounds Write
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-15819 CVE record

CVSS 7.5 High

IBM DataPower Gateway Out-of-bounds Write
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-15822 CVE record

CVSS 7.5 High

IBM DataPower Gateway Denial of Service
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- CWE-405
Not analysed yet 8 Oct 2026
CVE-2026-15824 CVE record

CVSS 8.2 High

IBM DataPower Gateway Denial of Service
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-16111 CVE record

CVSS 7.5 High

IBM DataPower Gateway Type Confusion
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-16159 CVE record

CVSS 8.6 High

IBM DataPower Gateway Out-of-bounds Write
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-16161 CVE record

CVSS 7.5 High

IBM DataPower Gateway Out-of-bounds Read
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-16164 CVE record

CVSS 7.5 High

IBM DataPower Gateway Out-of-bounds Write
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-16165 CVE record

CVSS 7.5 High

IBM DataPower Gateway NULL Pointer Dereference
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-16163 CVE record

CVSS 8.6 High

IBM DataPower Gateway Out-of-bounds Write
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-16167 CVE record

CVSS 7.5 High

IBM DataPower Gateway Out-of-bounds Write
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-16170 CVE record

CVSS 7.5 High

IBM DataPower Gateway Out-of-bounds Write
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-16176 CVE record

CVSS 7.5 High

IBM DataPower Gateway Denial of Service
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Denial of service
Not analysed yet 8 Oct 2026
CVE-2026-16177 CVE record

CVSS 5.3 Medium

IBM DataPower Gateway Out-of-bounds Read
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-16178 CVE record

CVSS 7.5 High

IBM DataPower Gateway Out-of-bounds Write
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-16340 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

IBM DataPower Gateway Out-of-bounds Write
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-16181 CVE record

CVSS 7.4 High

IBM DataPower Gateway Improper Authorization
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Broken access control
Not analysed yet 8 Oct 2026
CVE-2026-16179 CVE record

CVSS 7.5 High

IBM DataPower Gateway Buffer Underwrite
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-16182 CVE record

CVSS 5.9 Medium

IBM DataPower Gateway NULL Pointer Dereference
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Memory corruption
Not analysed yet 8 Oct 2026
CVE-2026-14521 CVE record

CVSS 4.9 Medium

IBM DataPower Gateway affected by server-side request forgery
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Server-side request forgery (SSRF)
Not analysed yet 8 Oct 2026
CVE-2026-7366 CVE record

CVSS 4.2 Medium

IBM DataPower Gateway affected by HTTP request header leakage in XML-Firewall
- IBM DataPower Gateway 11.0.0
- IBM DataPower Gateway 10.5.0
- Race condition
Not analysed yet 12 Aug 2026
CVE-2026-12733 CVE record

CVSS 7.5 High

IBM DataPower Gateway affected by denial of service
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Denial of service
Not analysed yet 30 Jul 2026
CVE-2025-36374 CVE record

CVSS 5.5 Medium

IBM DataPower Gateway affected by XML external entity injection
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.5.0
- XML external entities (XXE)
Not analysed yet 30 Jul 2026
CVE-2025-36375 CVE record

CVSS 6.5 Medium

IBM DataPower Gateway vulnerable to CSRF
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.5.0
- Cross-site request forgery (CSRF)
Not analysed yet 1 Apr 2026
CVE-2025-36373 CVE record

CVSS 4.1 Medium

Incorrect administrative access control in IBM DataPower Gateway
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.5.0
- Information disclosure
Not analysed yet 1 Apr 2026