NVD CRITICAL: CVE-2026-14990 — IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scr...

Thursday, October 8, 2026 at 02:16 PM UTC·Source: NIST NVD

Updated: Thursday, October 8, 2026 at 03:00 PM UTC

Executive Summary

IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Analysis

Indicators of Compromise (3)

CVE (1)

CVE-2026-14990

NVD MITRE CVE

IPv4 (2)

10.6.0.0

VirusTotal Shodan AbuseIPDB

10.6.0.10

VirusTotal Shodan AbuseIPDB

Source Attribution

Originally published by NIST NVD on Oct 8, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Orphaned VBA Projects Inside DWG Files: YARA Rule, (Sun, Oct 18th)

Here is the YARA rule I used to detect "Orphaned VBA Projects Inside DWG Files".

46m agoSANS ISC

CRITICALVulnerability

NVD CRITICAL: CVE-2026-111998 — Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allo...

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.

CVE-2026-111998

1h agoNIST NVD

MEDIUMVulnerability

More NHS staff sacked for accessing records of Nottingham stabbing victims

Ellie Ng reports: More NHS staff have been dismissed for inappropriately accessing medical records of the Nottingham stabbing victims, taking the total sacked so far to 15, a trust said. Students Barnaby Webber and Grace O’Malley-Kumar and grandfather Ian Coates were stabbed to death in the city by Valdo Calocane in 2023. During its investigation,... Source

2h agoDataBreaches.net