Login Request a demo
DG
Product
DataPower Gateway
by IBM · last CVE Oct 8, 2026
81
CVEs
0
On KEV
9.8
Max CVSS
39
New 30D
Vulnerabilities81In the news0Timeline
Severity mix
Critical 11High 40Medium 27Low 1
Severity
All severities81Critical11High40Medium27Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add DataPower Gateway to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-36373
6.8
0%
Apr 1
Incorrect administrative access control in IBM DataPower Gateway
Affected: 10.5.0.0 before 10.5.0.21; 10.6.0.0 before 10.6.0.9; 10.6.1.0 before 10.6.6.0
CVE-2020-5014
6.7
1%
Mar 8
IBM DataPower Gateway V10 and V2018 could allow a local attacker with administrative privileges to execute arbitrary code on the system using a server-side requesr forgery attack
Affected: 10.0.0.0 through 10.0.1.1; 2018.4.1.0 through 2018.4.1.14
CVE-2026-13257
6.5
0%
Oct 8
IBM DataPower Gateway Insufficient Verification of Data Authenticity
Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3
CVE-2026-14273
6.5
0%
Oct 8
IBM DataPower Gateway Incorrect Authorization
Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3
CVE-2020-4992
6.5
0%
Aug 17
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.16 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions…
Affected: 2018.4.1.0 through 2018.4.1.16
CVE-2020-4205
6.3
1%
Mar 19
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could allow an authenticated user to bypass security restrictions, and continue to access the server even after authentication…
Affected: 2018.4.1.0 through 2018.4.1.8
CVE-2021-38944
6.1
1%
May 18
IBM DataPower Gateway 10.0.2.0 through 1.0.3.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 is vulnerable to HTTP header injection, caused by improper validation…
Affected: 10.0.1.0 through 10.0.1.5; 10.0.2.0 through 10.0.3.0; 2018.4.1.0 through 2018.4.1.18
CVE-2017-1591
6.1
1%
Sep 28
IBM WebSphere DataPower Appliances 7.0.0 through 7.6 is vulnerable to cross-site scripting
Affected: 7.0.0.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +34 more
CVE-2026-14509
5.9
0%
Oct 8
IBM DataPower Gateway Denial of Service
Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3
CVE-2026-16182
5.9
0%
Oct 8
IBM DataPower Gateway NULL Pointer Dereference
Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3
CVE-2018-1663
5.9
2%
Dec 7
IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, 7.6, and 2018.4 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict…
Affected: 7.5.0.0 through 7.5.0.17; 7.5.1.0 through 7.5.1.16; 7.5.2.0 through 7.5.2.16; 7.6.0.0 through 7.6.0.9; 7.7.0.0 through 7.7.1.3; 2018.4
CVE-2020-4528
5.5
0%
Oct 6
IBM MQ Appliance (IBM DataPower Gateway 10.0.0.0 and 2018.4.1.0 through 2018.4.1.12) could allow a local user, under special conditions, to obtain highly sensitive information…
Affected: 2018.4.1.0 through 2018.4.1.12; 10.0.0.0
CVE-2018-1677
5.5
0%
Dec 20
IBM DataPower Gateways 7.1, 7.2, 7.5, 7.5.1, 7.5.2, 7.6, and 7.7 and IBM MQ Appliance are vulnerable to a denial of service, caused by the improper handling of full file system
Affected: 7.1.0.0 through 7.1.0.22; 7.2.0.0 through 7.2.0.20; 7.5.0.0 through 7.5.0.15; 7.5.1.0 through 7.5.1.14; 7.5.2.0 through 7.5.2.14; 7.6.0.0 through 7.6.0.7; +1 more
CVE-2018-1652
5.5
0%
Dec 11
IBM DataPower Gateway 7.1.0.0 through 7.1.0.19, 7.2.0.0 through 7.2.0.16, 7.5.0.0 through 7.5.0.10, 7.5.1.0 through 7.5.1.9, 7.5.2.0 through 7.5.2.9, and 7.6.0.0 through 7.6.0.2…
Affected: 7.1.0.0 through 7.1.0.19; 7.2.0.0 through 7.2.0.16; 7.5.0.0 through 7.5.0.10; 7.5.1.0 through 7.5.1.9; 7.5.2.0 through 7.5.2.9; 7.6.0.0 through 7.6.0.2
CVE-2026-13258
5.4
0%
Oct 8
IBM DataPower Gateway Cross-Site Scripting
Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3
CVE-2022-40228
5.4
0%
Nov 22
IBM DataPower Gateway 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 2018.4.1.22, and 10.5.0.0 through 10.5.0.2 does not invalidate session after a…
Affected: 10.0.1.0 through 10.0.1.9; 10.0.3.0 through 10.0.4.0; 10.5.0.0 through 10.5.0.2; 2018.4.1.0 through 2018.4.1.22
CVE-2022-32750
5.4
0%
Jul 31
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting
Affected: 2018.4.1.0; 10.0.1.0; 10.0.2.0; 10.0.4.0; 2018.4.1.21; 10.1.0.8; +1 more
CVE-2022-31774
5.4
0%
Jul 31
IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting
Affected: 2018.4.1.0; 10.0.1.0; 10.0.2.0; 10.0.4.0; 2018.4.1.21; 10.1.0.8; +1 more
CVE-2018-1667
5.4
1%
Dec 13
IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 is vulnerable to…
Affected: 7.5.0.0 through 7.5.0.18; 7.5.1.0 through 7.5.1.17; 7.5.2.0 through 7.5.2.17; 7.6.0.0 through 7.6.0.10; 7.7.0.0 through 7.7.1.3
CVE-2026-16177
5.3
0%
Oct 8
IBM DataPower Gateway Out-of-bounds Read
Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3
CVE-2021-38910
5.3
1%
Mar 10
IBM DataPower Gateway V10CD, 10.0.1, and 2108.4.1 could allow a remote attacker to bypass security restrictions, caused by the improper validation of input
Affected: 10.0.1.0 through 10.0.1.5; 2018.4.1.0 through 2018.4.1.18; 10.0.2.0; 10.0.3.0
CVE-2020-5008
5.3
1%
Jun 7
IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters
Affected: 10.0.0.0 through 10.0.1.0; 2018.4.1.0 through 2018.4.1.14
CVE-2026-14521
4.9
0%
Oct 8
IBM DataPower Gateway affected by server-side request forgery
Affected: 10.5.0.0 before 10.5.0.23; 10.6.0.0 before 10.6.0.11; 10.6.1.0 before 11.0.0.3; 11.0.0.0 before 11.0.0.3
CVE-2020-4203
4.9
1%
Mar 19
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could potentially disclose highly sensitive information to a privileged user due to improper access controls
Affected: 2018.4.1.0 through 2018.4.1.8
CVE-2018-1666
4.3
1%
Feb 7
IBM DataPower Gateway 2018.4.1.0, 7.6.0.0 through 7.6.0.11, 7.5.2.0 through 7.5.2.18, 7.5.1.0 through 7.5.1.18, 7.5.0.0 through 7.5.0.19, and 7.7.0.0 through 7.7.1.3 could allow…
Affected: 7.6.0.0; 7.5.2.0; 7.5.1.0; 7.5.0.0; 7.7.0.0; 7.7.1.3; +5 more
CVE-2026-7366
4.2
0%
Aug 12
IBM DataPower Gateway affected by HTTP request header leakage in XML-Firewall
Affected: 10.5.0.0 before 10.5.0.22; 10.6.0.0 before 10.6.0.10; 11.0.0.0 before 11.0.0.2
CVE-2017-1773
4.0
0%
Jan 31
IBM DataPower Gateways 7.1, 7,2, 7.5, and 7.6 could allow an attacker using man-in-the-middle techniques to spoof DNS responses to perform DNS cache poisoning and redirect…
Affected: 7.1.0.0 through 7.1.0.20; 7.2.0.0 through 7.2.0.17; 7.5.0.0 through 7.5.0.11; 7.5.1.0 through 7.5.1.10; 7.5.2.0 through 7.5.2.10; 7.6.0.0 through 7.6.0.3
Showing 27