DG
Product
DataPower Gateway
81
CVEs
0
On KEV
9.8
Max CVSS
39
New 30D
Severity mix
Critical 11High 40Medium 27Low 1
Watch
Add DataPower Gateway to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-14269 | 9.8 | Oct 8 | IBM DataPower Gateway Buffer Overflow Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-14502 | 9.8 | Oct 8 | IBM DataPower Gateway Improper Authentication Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-14888 | 9.8 | Oct 8 | IBM DataPower Gateway Buffer Overflow Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-14988 | 9.8 | Oct 8 | IBM DataPower Gateway Out-of-bounds Read Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-14992 | 9.8 | Oct 8 | IBM DataPower Gateway Out-of-bounds Write Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-14991 | 9.8 | Oct 8 | IBM DataPower Gateway Out-of-bounds Write Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-15762 | 9.8 | Oct 8 | IBM DataPower Gateway Out-of-bounds Write Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-16340 | 9.8 | Oct 8 | IBM DataPower Gateway Out-of-bounds Write Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2019-4621 | 9.8 | Dec 9 | IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is enabled Affected: 7.6.0.0 through 7.6.0.14; 2018.4.1.0 through 2018.4.1.5 |
| CVE-2026-14508 | 9.1 | Oct 8 | IBM DataPower Gateway Use After Free Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2022-31775 | 9.1 | Jul 31 | IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entity Injection (XXE)… Affected: 2018.4.1.0; 10.0.1.0; 10.0.2.0; 10.0.4.0; 10.5.0.0; 2018.4.1.20; +1 more |
| CVE-2025-36375 | 8.8 | Apr 1 | IBM DataPower Gateway vulnerable to CSRF Affected: 10.5.0.0 before 10.5.0.21; 10.6.0.0 before 10.6.0.9; 10.6.1.0 before 10.6.6.0 |
| CVE-2022-31773 | 8.8 | Aug 26 | IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… Affected: 10.0.1.0 before 10.5.0; 10.0.2.0 before 10.5.0; 2018.4.1.0 through 2018.4.1.21 |
| CVE-2022-31776 | 8.8 | Jul 31 | IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to server-side request forgery (SSRF) Affected: 2018.4.1.0; 10.0.1.0; 10.0.2.0; 10.0.4.0; 2018.4.1.21; 10.1.0.8; +1 more |
| CVE-2018-1661 | 8.8 | Dec 20 | IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… Affected: 7.5.0.0 through 7.5.0.17; 7.5.1.0 through 7.5.1.16; 7.5.2.0 through 7.5.2.16; 7.6.0.0 through 7.6.0.9 |
| CVE-2026-16159 | 8.6 | Oct 8 | IBM DataPower Gateway Out-of-bounds Write Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-16163 | 8.6 | Oct 8 | IBM DataPower Gateway Out-of-bounds Write Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-14496 | 8.2 | Oct 8 | IBM DataPower Gateway Out-of-bounds Read Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-14905 | 8.2 | Oct 8 | IBM DataPower Gateway XXE Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-15824 | 8.2 | Oct 8 | IBM DataPower Gateway Denial of Service Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-14497 | 8.1 | Oct 8 | IBM DataPower Gateway Improper Verification of Cryptographic Signature Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-15784 | 8.1 | Oct 8 | IBM DataPower Gateway Out-of-bounds Write Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-15781 | 8.0 | Oct 8 | IBM DataPower Gateway Buffer Overflow Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2019-4294 | 7.8 | Aug 20 | IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0.12, 9.1.0.0 through 9.1.0.2, and 9.1.1 through 9.1.2 could… Affected: before 2018.4.1.7; 7.6.0.0 through 7.6.0.15; 2018.4.1.0 through 2018.4.1.6 |
| CVE-2018-1664 | 7.8 | Sep 25 | IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD… Affected: 7.1.0.0 through 7.1.0.23; 7.2.0.0 through 7.2.0.21; 7.5.0.0 through 7.5.0.16; 7.5.1.0 through 7.5.1.15; 7.5.2.0 through 7.5.2.15; 7.6.0.0 through 7.6.0.8; +1 more |
| CVE-2026-14507 | 7.7 | Oct 8 | IBM DataPower Gateway Out-of-bounds Write Affected: 11.0.0.0 before 11.0.0.3 |
| CVE-2026-14999 | 7.5 | Oct 8 | IBM DataPower Gateway Improper Verification of Cryptographic Signature Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-15819 | 7.5 | Oct 8 | IBM DataPower Gateway Out-of-bounds Write Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-15822 | 7.5 | Oct 8 | IBM DataPower Gateway Denial of Service Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-16111 | 7.5 | Oct 8 | IBM DataPower Gateway Type Confusion Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-16161 | 7.5 | Oct 8 | IBM DataPower Gateway Out-of-bounds Read Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-16164 | 7.5 | Oct 8 | IBM DataPower Gateway Out-of-bounds Write Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-16165 | 7.5 | Oct 8 | IBM DataPower Gateway NULL Pointer Dereference Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-16167 | 7.5 | Oct 8 | IBM DataPower Gateway Out-of-bounds Write Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-16169 | 7.5 | Oct 8 | IBM DataPower Gateway Denial of Service Affected: 11.0.0.0 before 11.0.0.3 |
| CVE-2026-16170 | 7.5 | Oct 8 | IBM DataPower Gateway Out-of-bounds Write Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-16176 | 7.5 | Oct 8 | IBM DataPower Gateway Denial of Service Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-16178 | 7.5 | Oct 8 | IBM DataPower Gateway Out-of-bounds Write Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-16179 | 7.5 | Oct 8 | IBM DataPower Gateway Buffer Underwrite Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2026-12733 | 7.5 | Jul 30 | IBM DataPower Gateway affected by denial of service Affected: 10.5.0.0 before 10.5.0.22; 10.6.0.0 before 10.6.0.10; 10.6.1 through 10.6.6; 11.0.0.0 before 11.0.0.2 |
| CVE-2021-38872 | 7.5 | May 17 | IBM DataPower Gateway 10.0.2.0, 10.0.3.0, 10.0.1.0 through 10.0.1.4, and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a denial of service by consuming… Affected: 10.0.1.0 through 10.0.1.4; 2018.4.1.0 through 2018.4.1.17; 10.0.2.0; 10.0.3.0 |
| CVE-2020-4994 | 7.5 | May 17 | IBM DataPower Gateway 10.0.1.0 through 10.0.1.4 and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a temporary denial of service by sending invalid HTTP… Affected: 10.0.1.0 through 10.0.1.4; 2018.4.1.0 through 2018.4.1.17 |
| CVE-2020-4831 | 7.5 | Mar 12 | IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 10.0.0.0 through 10.0.1.0 |
| CVE-2020-4581 | 7.5 | Sep 21 | IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a chunked transfer-encoding HTTP/2 request Affected: 2018.4.1.0 through 2018.4.1.12 |
| CVE-2020-4580 | 7.5 | Sep 21 | IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially crafted a JSON request with invalid… Affected: 2018.4.1.0 through 2018.4.1.12 |
| CVE-2020-4579 | 7.5 | Sep 21 | IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.12 could allow a remote attacker to cause a denial of service by sending a specially crafted HTTP/2 request with invalid… Affected: 2018.4.1.0 through 2018.4.1.12 |
| CVE-2018-1668 | 7.5 | Jan 29 | IBM DataPower Gateway 7.5.0.0 through 7.5.0.19, 7.5.1.0 through 7.5.1.18, 7.5.2.0 through 7.5.2.18, and 7.6.0.0 through 7.6.0.11 appliances allows "null" logins which could give… Affected: 7.6.0.0; 7.5.2.0; 7.5.1.0; 7.5.0.0; 7.5.0.19; 7.5.1.18; +2 more |
| CVE-2018-1665 | 7.5 | Dec 13 | IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 uses weaker than expected… Affected: 7.5.0.0 through 7.5.0.18; 7.5.1.0 through 7.5.1.17; 7.5.2.0 through 7.5.2.17; 7.6.0.0 through 7.6.0.10; 7.7.0.0 through 7.7.1.3 |
| CVE-2026-16181 | 7.4 | Oct 8 | IBM DataPower Gateway Improper Authorization Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3 |
| CVE-2018-1669 | 7.1 | Sep 25 | IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD… Affected: 7.1.0.0 through 7.1.0.23; 7.2.0.0 through 7.2.0.21; 7.5.0.0 through 7.5.0.16; 7.5.1.0 through 7.5.1.15; 7.5.2.0 through 7.5.2.15; 7.6.0.0 through 7.6.0.8; +1 more |