Veille CVE

Semaine du 5 octobre au 11 octobre 2026

100 CVE

Critique 28 Élevée 45 Moyenne 27 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « IBM i » ✕
  1. CVE-2026-108577 4.3 Moyenne

    Konstanty Bialkowski libmodplug

    A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add_gchord of the file src/load_abc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

  2. CVE-2026-107819 5.9 Moyenne

    MariaDB server

    MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10.

  3. CVE-2026-87980 5.5 Moyenne

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive information due to cleartext storage of sensitive information in logs.

  4. CVE-2026-84891 7.5 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of hard-coded credentials.

  5. CVE-2026-84875 8.8 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

  6. CVE-2026-84249 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function.

  7. CVE-2026-84247 6.5 Moyenne

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.

  8. CVE-2026-84246 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

  9. CVE-2026-84230 5.9 Moyenne

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a race condition resulting from concurrent unsynchronized writes to a shared map.

  10. CVE-2026-84209 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

  11. CVE-2026-84198 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

  12. CVE-2026-84058 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A remote attacker who can send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector may cause a denial of service or potentially execute arbitrary code on the Collector appliance.

  13. CVE-2026-84057 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

  14. CVE-2026-84035 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.

  15. CVE-2026-84032 8.1 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2.2 could allow a remote attacker to conduct a man-in-the-middle attack due to improper certificate validation.

  16. CVE-2026-82900 9.1 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory.

  17. CVE-2026-82895 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

  18. CVE-2026-81932 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

  19. CVE-2026-80381 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection.

  20. CVE-2026-75875 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal.

  21. CVE-2026-95116 7.5 Élevée

    An issue in libming through 0.4.8 allows a remote attacker to cause a denial of service via the readtag_file() in src/blocks/fromswf.c.

  22. CVE-2026-78407 5.4 Moyenne

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

  23. CVE-2026-78406 9.8 Critique

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

  24. CVE-2026-78401 9.8 Critique

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

  25. CVE-2026-78399 6.5 Moyenne

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an authenticated user to cause a denial of service using a specially crafted HTTP query due to improper allocation of system resources

  26. CVE-2026-78388 8.8 Élevée

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

  27. CVE-2026-19878 6.5 Moyenne

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass additional authentication workflow steps.

  28. CVE-2026-19498 7.5 Élevée

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.

  29. CVE-2026-19494 6.5 Moyenne

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.

  30. CVE-2026-19493 7.5 Élevée

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to perform an arbitrary file write due to path traversal.

  31. CVE-2026-19491 7.5 Élevée

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass authentication due to improper authentication.

  32. CVE-2026-19482 8.8 Élevée

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of command arguments.

  33. CVE-2026-18740 8.8 Élevée

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to perform unauthorized actions due to argument injection.

  34. CVE-2026-17189 6.1 Moyenne

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session

  35. CVE-2026-16916 8.8 Élevée

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary code due to a protection mechanism failure.

  36. CVE-2026-16830 5.4 Moyenne

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to modify data and cause a denial of service due to an SQL injection vulnerability.

  37. CVE-2026-16823 7.5 Élevée

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass security restrictions due to improper authentication.

  38. CVE-2026-12109 7.2 Élevée

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an attacker with administrative privileges and access to the local management interface to execute arbitrary code due to an unbounded write to a fixed-size stack buffer.

  39. CVE-2026-12091 5.3 Moyenne

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a denial of service due to a heap-based out-of-bounds read. A remote attacker could send a specially crafted request that causes a limited out‑of‑bounds memory read.

  40. CVE-2026-11939 5.3 Moyenne

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may be vulnerable to audit log forgery.

  41. CVE-2026-11936 5.4 Moyenne

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management interface in certain configurations is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

  42. CVE-2026-11930 7.5 Élevée

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may not enforce authorization correctly for some web servers.

  43. CVE-2026-11888 7.5 Élevée

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to an information disclosure attack.

  44. CVE-2026-84275 7.5 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM file-upload functionality. An unauthenticated attacker could exploit this vulnerability to write arbitrary files to the Collector.

  45. CVE-2026-84274 6.5 Moyenne

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2.2 is affected by a sensitive information exposure vulnerability. During SECRET and API_KEY rotation processing, sensitive credential material is logged at INFO level by the edge-controller/edge-manager components. An authenticated attacker with access to the relevant application or container logs could obtain these credentials and use them to impersonate services or gain unauthorized access to the Guardium control plane.

  46. CVE-2026-84272 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters.

  47. CVE-2026-84271 7.8 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges.

  48. CVE-2026-84250 7.8 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protection and a hard-coded recovery key in the pkcrypto passkey component. A local attacker could exploit this vulnerability to recover the root password and gain root privileges.

  49. CVE-2026-84245 7.8 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 is vulnerable to a local privilege escalation in the cp_wrapper component. A low-privileged local user could exploit this vulnerability to gain root privileges and access or modify sensitive system files.

  50. CVE-2026-84244 6.1 Moyenne

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protection is vulnerable to stored cross-site scripting (XSS) in the Quick Search results grid. An unauthenticated attacker who can influence monitored database traffic could execute malicious script in the browser of an authenticated Guardium user.

  51. CVE-2026-82344 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functionality. An unauthenticated remote attacker can send crafted TDS login fragments that exceed the fixed-size reassembly buffer, potentially resulting in denial of service or arbitrary code execution on the affected system.

  52. CVE-2026-82335 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacker could send a specially crafted MongoDB SCRAM username containing an excessive length and cause memory corruption, potentially resulting in denial of service or arbitrary code execution.

  53. CVE-2026-82334 9.1 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser. A remote attacker could send a specially crafted TDS LOGIN7 packet containing invalid offset or length values, potentially causing information disclosure or denial of service.

  54. CVE-2026-84290 5.1 Moyenne

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the WfpMonitor kernel driver. Certain METHOD_NEITHER IOCTL handlers dereference user-controlled pointers without adequate probing and exception handling, potentially allowing a privileged local attacker to cause a system crash or perform limited kernel-memory reads.

  55. CVE-2026-84278 7.2 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges.

  56. CVE-2026-84276 7.5 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthenticated remote attacker with network access to the edge-controller gRPC service can provide malformed task data that triggers an unchecked type assertion, causing the edge-controller process to terminate unexpectedly.

  57. CVE-2026-106434 4.3 Moyenne

    MongoDB libmongocrypt

    The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application to process the supplied bytes as decrypted plaintext.

  58. CVE-2026-106433 8.8 Élevée

    MongoDB libmongocrypt

    Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process. This can terminate the application or corrupt process memory.

  59. CVE-2026-106429 6.5 Moyenne

    MongoDB libmongocrypt

    An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint containing a colon after its path or query during key creation. The issue does not access memory outside its allocated bounds.

  60. CVE-2026-95125 6.5 Moyenne

    libming through 0.4.8 contains a heap buffer overflow in r_readc() in src/blocks/fromswf.c. A crafted SWF file with a malformed or truncated RECT header can cause a denial of service.

  61. CVE-2026-14999 7.5 Élevée

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures.

  62. CVE-2026-14992 9.8 Critique

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 vulnerable to buffer overflow.

  63. CVE-2026-14988 9.8 Critique

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to buffer overflow.

  64. CVE-2026-14905 8.2 Élevée

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

  65. CVE-2026-14888 9.8 Critique

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow.

  66. CVE-2026-14509 5.9 Moyenne

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to algorithmic complexity in linked-list traversal.

  67. CVE-2026-14508 9.1 Critique

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service and obtain sensitive information due to a use-after-free.

  68. CVE-2026-14507 7.7 Élevée

    IBM DataPower Gateway 11.0.0 · Ibm datapower gateway

    IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service due to improper memory allocation during key derivation.

  69. CVE-2026-14502 9.8 Critique

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject empty passwords during LDAP authentication.

  70. CVE-2026-14497 8.1 Élevée

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security restrictions due to improper verification of cryptographic signatures.

  71. CVE-2026-14496 8.2 Élevée

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.

  72. CVE-2026-14273 6.5 Moyenne

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obtain sensitive information due to improper authorization.

  73. CVE-2026-14269 9.8 Critique

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. An unauthenticated remote attacker could overflow the buffer and execute arbitrary code on the system.

  74. CVE-2026-13258 5.4 Moyenne

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

  75. CVE-2026-13257 6.5 Moyenne

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated user to forge signature requests due to improper verification of data authenticity.

  76. CVE-2026-16167 7.5 Élevée

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper bounds checking.

  77. CVE-2026-16165 7.5 Élevée

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a null pointer dereference.

  78. CVE-2026-16164 7.5 Élevée

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a buffer overflow.

  79. CVE-2026-16163 8.6 Élevée

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause memory corruption due to an out-of-bounds write.

  80. CVE-2026-16161 7.5 Élevée

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

  81. CVE-2026-16159 8.6 Élevée

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds write.

  82. CVE-2026-16111 7.5 Élevée

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a type confusion flaw.

  83. CVE-2026-15824 8.2 Élevée

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.

  84. CVE-2026-15822 7.5 Élevée

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper memoization of GraphQL fragment spreads.

  85. CVE-2026-15819 7.5 Élevée

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to out-of-bounds memory access caused by a strict-weak-ordering violation in a sorting comparator.

  86. CVE-2026-15784 8.1 Élevée

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.

  87. CVE-2026-15781 8.0 Élevée

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow.

  88. CVE-2026-15762 9.8 Critique

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.

  89. CVE-2026-14991 9.8 Critique

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.

  90. CVE-2026-14990 9.3 Critique

    IBM DataPower Gateway 10.6.0

    IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

  91. CVE-2026-16340 9.8 Critique

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write in the RFC2047 encoded-word parser.

  92. CVE-2026-16182 5.9 Moyenne

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a NULL pointer dereference in GraphQL variable processing.

  93. CVE-2026-16181 7.4 Élevée

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass security restrictions due to improper authorization.

  94. CVE-2026-16179 7.5 Élevée

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a heap buffer underwrite and potentially crash the service.

  95. CVE-2026-16178 7.5 Élevée

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper input validation.

  96. CVE-2026-16177 5.3 Moyenne

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.

  97. CVE-2026-16176 7.5 Élevée

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper validation of the length field during memory reallocation.

  98. CVE-2026-16170 7.5 Élevée

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.

  99. CVE-2026-16169 7.5 Élevée

    IBM DataPower Gateway 11.0.0 · Ibm datapower gateway

    IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

  100. CVE-2026-14521 4.9 Moyenne

    IBM DataPower Gateway 10.6CD · IBM DataPower Gateway 10.6.0 · IBM DataPower Gateway 11.0.0 · IBM DataPower Gateway 10.5.0

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.