{"id":"CVE-2026-14990","published":"2026-10-08T14:16:51.603","lastModified":"2026-10-08T20:49:50.083","description":"IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7289790","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This flaw allows unauthenticated users to inject arbitrary JavaScript code into the Web UI of IBM DataPower Gateway, potentially leading to credential theft.","exploitability":"Exploitation requires access to the Web UI and is relatively straightforward given the unauthenticated nature of the vulnerability.","blast_radius":"If exploited, the vulnerability could result in unauthorized access to sensitive information within trusted sessions.","remediation":"Upgrade to IBM DataPower Gateway 10.6.0.11 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","web","unauth","ui"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-09T08:43:23.955Z"}}