CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-14269 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....

·Source: NIST NVD

Updated:

Executive Summary

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. An unauthenticated remote attacker could overflow the buffer and execute arbitrary code on the system.

Analysis

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. An unauthenticated remote attacker could overflow the buffer and execute arbitrary code on the system. CVSS Score: 9.8. Published: 2026-10-08T15:17:48.600.

Indicators of Compromise (7)

CVE (1)
CVE-2026-14269
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 8, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

NASA CIO Ties IT Modernization to Mission Goals

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/nasa-cio-ties-modernization-to-mission-goals-image_small-5-a-33145.jpg" align=right hspace=4><b>Network and Cloud Upgrades Support NASAs Lunar and Science Missions</b><br>NASA CIO Sean Gallagher says modernization must follow mission needs, from resilient networks and shared services to cloud and financial system upgrades. He expl

Bank Info Security
MEDIUMVulnerabilityNEW

Judge denies WhatsApp’s bid to hold spyware maker in contempt for allegedly targeting users

WhatsApp argued that NSO Group violated a 2025 injunction against using the messaging app to spread spyware. A federal judge said WhatsApp hurt its case by not revealing enough information.

The Record
CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-109437 — Cognition before 0.13.0 contains an unauthenticated remote code execution vulner...

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST /sessions/{id}/messages without credentials, causing the Deep Agents ReAct loop to run attacker-directed shell commands

CVE-2026-109437
NIST NVD