HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-14999 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....

·Source: NIST NVD

Updated:

Executive Summary

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures.

Analysis

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures. CVSS Score: 7.4. Published: 2026-10-08T15:17:50.360.

Indicators of Compromise (7)

CVE (1)
CVE-2026-14999
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 8, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

23andMe successor settles with California for $6 million over cybersecurity failings

California Attorney General Rob Bonta announced a settlement under which 23andMe's successor will pay $6 million to resolve allegations that the company did not properly protect customers' data before a 2023 breach.

The Record
CRITICALVulnerability

NVD CRITICAL: CVE-2026-113802 — Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command inj...

Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del to popen(). A remote unauthenticated attacker can send a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.

CVE-2026-113802
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-113506 — A vulnerability has been found in aaPanel up to 8.25.0. The affected element is ...

A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The repo

CVE-2026-113506
NIST NVD