HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-14888 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....

·Source: NIST NVD

Updated:

Executive Summary

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow.

Analysis

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow. CVSS Score: 8.1. Published: 2026-10-08T15:17:49.700.

Indicators of Compromise (7)

CVE (1)
CVE-2026-14888
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 8, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-77936 — Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECU...

Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST /v1/tools/run, manage /v1/admin users, or run OS commands via COPY PROGRAM.

CVE-2026-77936
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-77933 — DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its defau...

DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access including FILE and SUPER privileges.

CVE-2026-77933
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-77932 — DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerabi...

DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools run arbitrary Python or bash as root in the webserve

CVE-2026-77932
NIST NVD