Threat database

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a buffer overflow.

A null pointer dereference vulnerability exists in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. This flaw could allow a remote attacker to cause a denial of service condition by triggering the null pointer dereference.

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause memory corruption due to an out-of-bounds write.

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper bounds checking.

IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper validation of the length field during memory reallocation.

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.

CVE-2026-16178 is a high severity vulnerability in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. It involves an out-of-bounds write due to improper input validation that could allow a remote attacker to cause a denial of service. The vulnerability does not impact confidentiality or integrity but affects availability. No vendor advisory or patch information is provided in the input data.

CVE-2026-16340 is a critical vulnerability in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. It involves an out-of-bounds write in the RFC2047 encoded-word parser that could allow a remote attacker to execute arbitrary code without authentication.

CVE-2026-16181 is an improper authorization vulnerability in IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2. This flaw could allow a remote attacker to bypass security restrictions without authentication. The vulnerability has a high severity rating with a CVSS score of 7.4, indicating a significant impact on confidentiality and integrity. No known exploits are reported in the wild, and no vendor advisory or patch information is provided in the input data.

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a heap buffer underwrite and potentially crash the service.

IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a NULL pointer dereference in GraphQL variable processing.

IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 contain a server-side request forgery (SSRF) vulnerability. This flaw allows an authenticated attacker with low privileges to send unauthorized requests from the affected system. The vulnerability could enable network enumeration or assist in other attacks. The CVSS 3.1 base score is 4.9, indicating medium severity. No public exploits or patch information are provided in the available data.

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a vulnerability (CWE-94) that allows a remote authenticated attacker to execute arbitrary code due to improper control of code generation. This vulnerability has a high severity with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.

CVE-2026-93443 is a high-severity vulnerability in IBM Langflow OSS versions 1.0.0 through 1.12.2. It allows a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code, classified as CWE-94 (Code Injection). The vulnerability requires low privileges and high attack complexity. No official patch information is provided in the input data.

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a path traversal vulnerability (CWE-22) that allows a remote authenticated attacker to access sensitive information by improperly limiting pathnames to restricted directories. This vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity. The flaw does not impact integrity or availability but allows unauthorized disclosure of information. No official patch or remediation details are provided in the available data.

CVE-2026-93449 is a high-severity vulnerability in IBM Langflow OSS versions 1.0.0 through 1.12.2. It allows a remote authenticated attacker to execute arbitrary code due to improper control of code generation, classified as CWE-94 (Code Injection). The vulnerability has a CVSS 3.1 score of 8.5, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation information is provided in the available data.

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a vulnerability (CWE-94) that allows a remote authenticated attacker to execute arbitrary code due to improper control of code generation. This vulnerability has a high severity with a CVSS score of 8.1. No patch or remediation details are provided in the available data.