🚨 CVE-2026-16165
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a null pointer dereference.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a null pointer dereference.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-16167
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper bounds checking.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper bounds checking.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-13257
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated user to forge signature requests due to improper verification of data authenticity.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated user to forge signature requests due to improper verification of data authenticity.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-13258
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-14269
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. An unauthenticated remote attacker could overflow the buffer and execute arbitrary code on the system.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. An unauthenticated remote attacker could overflow the buffer and execute arbitrary code on the system.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-14273
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obtain sensitive information due to improper authorization.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obtain sensitive information due to improper authorization.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-14496
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-14497
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security restrictions due to improper verification of cryptographic signatures.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security restrictions due to improper verification of cryptographic signatures.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-14502
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject empty passwords during LDAP authentication.
🎖@cveNotify
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject empty passwords during LDAP authentication.
🎖@cveNotify
Ibm
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs
IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23
🚨 CVE-2026-107675
FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output.
🎖@cveNotify
FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output.
🎖@cveNotify
FFmpeg Forgejo
avformat/libssh: verify the SSH server host key · 2b822b7fb6
The sftp protocol connected and authenticated without checking the server
host key, so credentials were sent to any or spoofed server. Verify against
known_hosts (ssh_session_is_known_server, with a pre-0.8 fallback) before
authenticating; add a 'verify'…
host key, so credentials were sent to any or spoofed server. Verify against
known_hosts (ssh_session_is_known_server, with a pre-0.8 fallback) before
authenticating; add a 'verify'…
🚨 CVE-2026-107676
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files.
🎖@cveNotify
FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files.
🎖@cveNotify
FFmpeg Forgejo
avutil/hdr_dynamic_metadata: fix uninitialized bytes when color saturation is set without tone mapping · 2c2f6e96e3
The write loop in av_dynamic_hdr_plus_to_t35() nested the
color_saturation_mapping_flag and color_saturation_weight put_bits
calls inside the tone_mapping_flag block, while the size calculation
and the parser treat these fields as unconditional per window.…
color_saturation_mapping_flag and color_saturation_weight put_bits
calls inside the tone_mapping_flag block, while the size calculation
and the parser treat these fields as unconditional per window.…
🚨 CVE-2026-107677
FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely.
🎖@cveNotify
FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media="" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely.
🎖@cveNotify
FFmpeg Forgejo
avutil/avstring: fix infinite loop in av_strireplace with empty search string · ed27bfcbbb
av_stristr() returns the input pointer unchanged for an empty needle,
so an empty 'from' argument left pstr never advancing and caused
av_strireplace() to loop forever (and grow the buffer unboundedly if
'to' was non-empty). Return a duplicate of 'str' when…
so an empty 'from' argument left pstr never advancing and caused
av_strireplace() to loop forever (and grow the buffer unboundedly if
'to' was non-empty). Return a duplicate of 'str' when…
🚨 CVE-2026-107678
FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption.
🎖@cveNotify
FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption.
🎖@cveNotify
FFmpeg Forgejo
avutil/encryption_info: avoid stack exhaustion freeing init info list
Fixes: Stack overflow
Found-by: Joshua Rogers <joshua.rogers@aisle.com>
Fixes: tyKGcmR25mD8
Found-by: Joshua Rogers <joshua.rogers@aisle.com>
Fixes: tyKGcmR25mD8
🚨 CVE-2026-107695
FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption.
🎖@cveNotify
FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption.
🎖@cveNotify
FFmpeg Forgejo
avformat/hls: reject Master Playlist tags in a Media Playlist
Fixes: recursion.m3u8
Fixes: cEy2cxyyPaLH
Fixes: cd223e0b4e (Add Apple HTTP Live Streaming demuxer)
Found-by: BapToutatis
Fixes: cEy2cxyyPaLH
Fixes: cd223e0b4e (Add Apple HTTP Live Streaming demuxer)
Found-by: BapToutatis
🚨 CVE-2026-107696
FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core.
🎖@cveNotify
FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core.
🎖@cveNotify
FFmpeg Forgejo
avformat/rtsp: limit the number of redirects
Fixes: 2OgPp3duxpWM
Found-by: BapToutatis
Endless redirect loop Replicated through UnModified FFmpeg with rogue RTSP servers
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Found-by: BapToutatis
Endless redirect loop Replicated through UnModified FFmpeg with rogue RTSP servers
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
🚨 CVE-2026-107697
FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block.
🎖@cveNotify
FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block.
🎖@cveNotify
GitHub
GitHub - FFmpeg/FFmpeg: Mirror of https://git.ffmpeg.org/ffmpeg.git
Mirror of https://git.ffmpeg.org/ffmpeg.git. Contribute to FFmpeg/FFmpeg development by creating an account on GitHub.
🚨 CVE-2026-107698
FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services.
🎖@cveNotify
FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services.
🎖@cveNotify
FFmpeg Forgejo
avformat: Add ff_format_check_set_url() and use in rtsp
avformat/rtsp: Use ff_format_check_set_url()
Fixes: redirect to blacklisted protocol
Fixes: YWH-PGM40646-41
Found-by: BapToutatis
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Fixes: redirect to blacklisted protocol
Fixes: YWH-PGM40646-41
Found-by: BapToutatis
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
🚨 CVE-2026-84198
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
🎖@cveNotify
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
🎖@cveNotify
Ibm
Security Bulletin: Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection
Multiple vulnerabilities have been addressed in the Sniffer component as part of IBM Guardium Data Protection
🚨 CVE-2026-84209
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
🎖@cveNotify
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
🎖@cveNotify
Ibm
Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.
IBM Guardium Data Protection has addressed these vulnerabilities in an update.
🚨 CVE-2026-84230
IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a race condition resulting from concurrent unsynchronized writes to a shared map.
🎖@cveNotify
IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a race condition resulting from concurrent unsynchronized writes to a shared map.
🎖@cveNotify
Ibm
Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities
IBM Guardium Data Protection has addressed these vulnerabilities in an update.
🚨 CVE-2026-82096
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
🎖@cveNotify
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
🎖@cveNotify
Ibm
Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities
Several vulnerabilities were found in DataStage on Cloud Pak for Data