Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA, the probability of exploitation (EPSS) and public exploits – each one researched individually: what is affected, what helps, what to do.
Per day (UTC); hover over a bar for the figures.
| Day | Critical | High | Medium | Low | Not rated | Total |
|---|---|---|---|---|---|---|
| Sun, 1 Nov 2026 | 8 | 16 | 24 | 14 | 24 | 86 |
| Sat, 31 Oct 2026 | 11 | 44 | 51 | 1 | 5 | 112 |
| Fri, 30 Oct 2026 | 44 | 216 | 259 | 30 | 120 | 669 |
| Thu, 29 Oct 2026 | 66 | 191 | 218 | 22 | 40 | 537 |
| Wed, 28 Oct 2026 | 35 | 215 | 209 | 31 | 136 | 626 |
| Tue, 27 Oct 2026 | 69 | 188 | 177 | 33 | 181 | 648 |
| Mon, 26 Oct 2026 | 21 | 130 | 245 | 55 | 287 | 738 |
| Sun, 25 Oct 2026 | 3 | 31 | 66 | 26 | 5 | 131 |
| Sat, 24 Oct 2026 | 12 | 19 | 35 | 6 | 1 | 73 |
| Fri, 23 Oct 2026 | 40 | 169 | 90 | 27 | 166 | 492 |
| Thu, 22 Oct 2026 | 69 | 160 | 206 | 55 | 2 | 492 |
| Wed, 21 Oct 2026 | 50 | 218 | 225 | 47 | 2 | 542 |
| Tue, 20 Oct 2026 | 169 | 813 | 812 | 127 | 2 | 1,923 |
| Mon, 19 Oct 2026 | 29 | 128 | 204 | 66 | 10 | 437 |
| Sun, 18 Oct 2026 | 10 | 55 | 65 | 19 | 400 | 549 |
| Sat, 17 Oct 2026 | 4 | 42 | 50 | 4 | 0 | 100 |
| Fri, 16 Oct 2026 | 53 | 179 | 219 | 14 | 0 | 465 |
| Thu, 15 Oct 2026 | 51 | 232 | 244 | 19 | 0 | 546 |
| Wed, 14 Oct 2026 | 92 | 374 | 285 | 30 | 43 | 824 |
| Tue, 13 Oct 2026 | 170 | 1,361 | 729 | 43 | 0 | 2,303 |
| Mon, 12 Oct 2026 | 48 | 264 | 282 | 80 | 0 | 674 |
| Sun, 11 Oct 2026 | 16 | 73 | 101 | 39 | 0 | 229 |
| Sat, 10 Oct 2026 | 78 | 143 | 178 | 13 | 0 | 412 |
| Fri, 9 Oct 2026 | 42 | 152 | 105 | 11 | 5 | 315 |
| Thu, 8 Oct 2026 | 62 | 194 | 220 | 21 | 0 | 497 |
| Wed, 7 Oct 2026 | 53 | 131 | 145 | 9 | 2 | 340 |
| Tue, 6 Oct 2026 | 105 | 371 | 345 | 38 | 155 | 1,014 |
| Mon, 5 Oct 2026 | 31 | 119 | 210 | 45 | 0 | 405 |
| Sun, 4 Oct 2026 | 13 | 16 | 28 | 11 | 0 | 68 |
| Sat, 3 Oct 2026 | 5 | 45 | 57 | 8 | 0 | 115 |
202 vulnerabilities · Vendor: IBM
IBM DataPower Gateway processes XML data in the affected versions without properly restricting external entity references. A remote attacker can exploit this over the network, without privileges, to expose sensitive information or consume memory resources. IBM rates the CVSS base score at 8.2. Exposure depends on whether the gateway is reachable from untrusted networks.
IBM · DataPower Gateway
IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.0.0 to 10.6.0.10, 10.6.1 to 10.6.6 and 11.0.0.0 to 11.0.0.2 contain a heap-based buffer overflow (CWE-122). According to the CVE record, a remote attacker can exploit it without authentication to execute arbitrary code, which could give full control over the gateway. The CVSS base score is 9.8 (CRITICAL) in the CVE record.
IBM · DataPower Gateway
Research and translation in progress – available shortly.
A use-after-free flaw (CWE-416) in IBM DataPower Gateway can be triggered remotely. IBM's vector shows no authentication required, but high attack complexity. A successful attack can crash the service (denial of service) and expose sensitive information. IBM rates the issue 6.5 (Medium), while the NVD record provided here shows 9.1 (Critical).
IBM · DataPower Gateway
Research and translation in progress – available shortly.
IBM DataPower Gateway does not reject empty passwords during LDAP authentication in the affected versions. A remote attacker can use this to obtain administrative access without valid credentials, without prior privileges and without user interaction. NVD rates the issue CVSS 9.8 (Critical) and classifies it as CWE-287 (Improper Authentication).
IBM · DataPower Gateway
IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.1 to 10.6.6, 10.6.0.0 to 10.6.0.10 and 11.0.0.0 to 11.0.0.2 do not properly verify cryptographic signatures. A remote attacker with valid low-privilege credentials can bypass security restrictions, with high impact on confidentiality and integrity. IBM rates the issue at CVSS 8.1.
IBM · DataPower Gateway
IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.1 to 10.6.6, 10.6.0.0 to 10.6.0.10 and 11.0.0.0 to 11.0.0.2 contain a heap-based buffer overflow. A remote, unauthenticated attacker can exploit it without user interaction to crash or disrupt the gateway service. The CVE record describes denial of service only, and no code execution is claimed. NVD and the CNA rate it 8.2, while IBM rates it 7.5 with no confidentiality impact.
IBM · DataPower Gateway
Research and translation in progress – available shortly.
IBM DataPower Gateway contains a heap-based buffer overflow caused by improper bounds checking. According to the CVE description, an unauthenticated remote attacker can overflow the buffer and execute arbitrary code on the system. The CVSS base score is 9.8 (critical), and the vulnerability is in versions 10.5.0.0 to 10.5.0.22, 10.6.0.0 to 10.6.0.10, 10.6.1 to 10.6.6 and 11.0.0.0 to 11.0.0.2.
IBM · DataPower Gateway
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.0.0 to 10.6.0.10, 10.6.1 to 10.6.6 and 11.0.0.0 to 11.0.0.2 contain an out-of-bounds write (CWE-787). A remote attacker can cause memory corruption in the gateway without authentication or user interaction. The CVSS 3.1 vector rates the main impact as availability (high), with low confidentiality and integrity impact. No public exploitation has been reported in the research.
IBM · DataPower Gateway
Research and translation in progress – available shortly.
Multiple IBM DataPower Gateway versions in the 10.5.0, 10.6.0, 10.6CD and 11.0.0 branches contain an out-of-bounds write (CWE-787). A remote attacker can exploit it over the network without authentication and with low complexity to obtain sensitive information and cause a denial of service. The impact is mainly availability, with a limited confidentiality impact.
IBM · DataPower Gateway
Research and translation in progress – available shortly.
IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.0.0 to 10.6.0.10, 10.6.1 to 10.6.6 and 11.0.0.0 to 11.0.0.2 contain a heap-based buffer overflow (CWE-787). A remote attacker can exploit it without authentication to crash the gateway and cause a Denial of Service. Because DataPower often sits at the edge of integration and API traffic, a crash can disrupt every service behind it.
IBM · DataPower Gateway
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
IBM DataPower Gateway contains an out-of-bounds write (CWE-787) that can allow a remote attacker to execute arbitrary code. The NVD and IBM rate it CVSS 3.1 8.1 (High). The vector requires high attack complexity but no privileges and no user interaction, so internet-exposed gateways are the priority.
IBM · DataPower Gateway
IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.1 to 10.6.6, 10.6.0.0 to 10.6.0.10 and 11.0.0.0 to 11.0.0.2 contain a stack-based buffer overflow (CWE-121). A remote attacker with valid credentials and high privileges could execute arbitrary code on the gateway, which can lead to full compromise of confidentiality, integrity and availability. Exploitation requires high attack complexity and a scope change, according to the CVSS vector.
IBM · DataPower Gateway
IBM DataPower Gateway versions 10.5.0.0 to 10.5.0.22, 10.6.0.0 to 10.6.0.10, 10.6.1 to 10.6.6 (10.6CD) and 11.0.0.0 to 11.0.0.2 contain an out-of-bounds write (CWE-787). A remote attacker can exploit it without authentication and user interaction to execute arbitrary code, which may compromise confidentiality, integrity and availability of the gateway. The CVSS base score is 9.8 (critical). The gateway is the relevant risk driver, so internet-facing instances are the highest priority.
IBM · DataPower Gateway
The tracker combines official, freely usable data sources – updated continuously:
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
