CVE-2025-36374 IBM DataPower Gateway affected by XML external entity injection

IBM DataPower Gateway is vulnerable to an XML external entity injection XXE attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources...

EUVD-2025-210545

IBM DataPower Gateway is vulnerable to an XML external entity injection XXE attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2025-36374

IBM DataPower Gateway is affected by CVE-2025-36374 due to an XML External Entity (XXE) vulnerability (CWE-611). The issue occurs when processing XML data and could allow a privileged user to expose sensitive information or exhaust memory. Affected products/versions include DataPower Gateway 10.6...

CVE-2025-36374

IBM DataPower Gateway is vulnerable to an XML external entity injection XXE attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources...

PT-2026-66555

IBM DataPower Gateway is vulnerable to an XML external entity injection XXE attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2026-12733: Allocation of Resources Without Limits or Throttling

IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations...

PT-2026-66557

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway affected versions not specified Description Improper resource limitations may allow a remote attacker to cause a denial of service. Recommendations At the moment, there is no information about a newer version that contain...

CVE-2025-36374: Improper Restriction of XML External Entity Reference

IBM DataPower Gateway is vulnerable to an XML external entity injection XXE attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources...

Security Bulletin: IBM DataPower Gateway affected by local privilege escalation due to VMware Tools (CVE-2025-41244)

Summary IBM DataPower Gateway affected by local privilege escalation due to VMware Tools CVE-2025-41244 Vulnerability Details CVEID:CVE-2025-41244 DESCRIPTION: VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrati...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in OS kernel

Summary The following CVEs in the OS kernel may affect IBM DataPower Gateway Vulnerability Details CVEID:CVE-2025-38180 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: net: atm: fix /proc/net/atm/lec handling /proc/net/atm/lec must ensure safety against devlec...

Security Bulletin: IBM DataPower Gateway affected by cross-site scripting due to DOMPurify (CVE-2026-0540)

Summary DOMPurify is used by the UI component of IBM DataPower Gateway Vulnerability Details CVEID:CVE-2026-0540 DESCRIPTION: DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in OS kernel

Summary The following CVEs in the OS kernel may affect IBM DataPower Gateway Vulnerability Details CVEID:CVE-2024-26984 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: nouveau: fix instmem race condition around ptr stores Running a lot of VK CTS in parallel agains...

Security Bulletin: IBM DataPower Gateway vulnerable to memory corruption in OS kernel (CVE-2023-53178)

Summary IBM DataPower Gateway vulnerable to memory corruption in OS kernel CVE-2023-53178 Vulnerability Details CVEID:CVE-2023-53178 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: mm: fix zswap writeback race condition The zswap writeback mechanism can cause a ra...

Security Bulletin: IBM DataPower Gateway affected by XML external entity injection (CVE-2025-36374)

Summary IBM DataPower Gateway affected by XML external entity injection CVE-2025-36374 Vulnerability Details CVEID:CVE-2025-36374 DESCRIPTION: IBM DataPower Gateway is vulnerable to an XML external entity injection XXE attack when processing XML data. A privileged user could exploit this...

Security Bulletin: IBM DataPower Gateway affected by prototype pollution due to Axios (CVE-2026-42264)

Summary Axios is used by the UI and Gateway Director components of IBM DataPower Gateway Vulnerability Details CVEID:CVE-2026-42264 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties auth, baseURL,...

Security Bulletin: IBM DataPower Gateway affected by denial of service (CVE-2026-12733)

Summary IBM DataPower Gateway affected by denial of service CVE-2026-12733 Vulnerability Details CVEID:CVE-2026-12733 DESCRIPTION: IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations. CWE:CWE-770: Allocation of Resources Without...

IBM DataPower Gateway Information Disclosure Vulnerability (CNVD-2026-19179)

IBM DataPower Gateway is a suite of International Business Machines IBM security and integration platforms designed specifically for mobile, cloud, application programming interfaces APIs, web, service-oriented architecture SOA, B2B and cloud workloads. The platform protects, integrates and...

IBM DataPower Gateway Cross-Site Request Forgery Vulnerability (CNVD-2026-19180)

IBM DataPower Gateway is an enterprise-grade application security gateway that provides API management and traffic control capabilities. A cross-site request forgery vulnerability exists in IBM DataPower Gateway. The vulnerability arises because the system fails to effectively validate the source...

Security Bulletin: IBM DataPower Gateway potentially affected by multiple vulnerabilities in JRE

Summary While IBM DataPower Gateway does not itself use Java and is therefore not vulnerable to these CVEs, some bundled components do, hence the JRE has been updated to address the listed issues Vulnerability Details CVEID:CVE-2026-21945 DESCRIPTION: Java SE is vulnerable to a denial of service,...

Security Bulletin: IBM DataPower Gateway affected by potential memory corruption

Summary This kernel CVE may cause crashes or memory corruption. Vulnerability Details CVEID:CVE-2025-39971 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: i40e: fix idx validation in config queues msg Ensure idx is within range of active/initialized TCs when...