CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-16340 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0....

·Source: NIST NVD

Updated:

Executive Summary

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write in the RFC2047 encoded-word parser.

Analysis

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write in the RFC2047 encoded-word parser. CVSS Score: 9.8. Published: 2026-10-08T13:17:16.610.

Indicators of Compromise (7)

CVE (1)
CVE-2026-16340
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 8, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

NASA CIO Ties IT Modernization to Mission Goals

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/nasa-cio-ties-modernization-to-mission-goals-image_small-5-a-33145.jpg" align=right hspace=4><b>Network and Cloud Upgrades Support NASAs Lunar and Science Missions</b><br>NASA CIO Sean Gallagher says modernization must follow mission needs, from resilient networks and shared services to cloud and financial system upgrades. He expl

Bank Info Security
MEDIUMVulnerabilityNEW

Judge denies WhatsApp’s bid to hold spyware maker in contempt for allegedly targeting users

WhatsApp argued that NSO Group violated a 2025 injunction against using the messaging app to spread spyware. A federal judge said WhatsApp hurt its case by not revealing enough information.

The Record
CRITICALVulnerability

NVD CRITICAL: CVE-2026-109437 — Cognition before 0.13.0 contains an unauthenticated remote code execution vulner...

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST /sessions/{id}/messages without credentials, causing the Deep Agents ReAct loop to run attacker-directed shell commands

CVE-2026-109437
NIST NVD