VDB
CVE-2026-14990
CVE-2026-14990
PUBLISHED
As of October 8, 2026, IBM is affected by vulnerabilities in the following products: IBM DataPower Gateway 10.5.0 Prior to or equal to 10.5.0.22 IBM DataPower Gateway 10.6.0 Prior to or equal to 10.6.0.10 IBM DataPower Gateway 10.6CD Prior to or equal to 10.6.6 IBM DataPower Gateway 11.0.0 Prior to or equal to 11.0.0.2 Langflow OSS Version 1.0.0 to 1.12.2 The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.
EPSS 0.31% · 21.9th percentile
Risk Scores
EPSS Score
0.31%
21.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Prior | Prior to or equal to 10.5.0.22 | |
| Version | Version 1.0.0 to 1.12.2 | |
| Prior | Prior to or equal to 10.6.0.10 | |
| Prior | Prior to or equal to 10.6.6 | |
| Prior | Prior to or equal to 11.0.0.2 |
Timeline
- Sep 28, 2026 CVE Published
- Oct 9, 2026 EPSS Score
- Oct 13, 2026 EPSS Score
- Oct 15, 2026 EPSS Score
References
- https://cyber.gc.ca/en/alerts-advisories/ibm-security-advisory-av26-1022 advisory
- https://www.ibm.com/support/pages/security-bulletin-ibm-datapower-gateway-affected-cross-site-scripting-cve-2026-14990 vendor
- https://www.ibm.com/support/pages/node/7289775 vendor
- https://www.ibm.com/support/pages/node/7290694 vendor
- https://www.ibm.com/support/pages/bulletin/ vendor