Threat database

IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe operations.

CVE-2026-12350 is a vulnerability in IBM MQ Operator where an authenticated attacker can cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process. The vulnerability is related to deserialization of untrusted data (CWE-502). It affects multiple versions of IBM MQ Operator. The CVSS v3.1 base score is 6.5, indicating a medium severity. There is no information about available patches or vendor advisories specifying remediation.

IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation.

IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment.

IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected.

IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing specially crafted object names.

IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive memory operations during character set conversion.

IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature.

IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10 contain a vulnerability related to deserialization of untrusted data. This flaw allows an unauthenticated remote attacker to corrupt the persisted status of batch job instances. The vulnerability has a high severity with a CVSS score of 8.2, indicating significant impact on integrity and some impact on availability.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10 contain a critical authentication bypass vulnerability related to session fixation when the samlWeb-2.0 feature is enabled. This flaw allows an attacker to bypass authentication, potentially leading to full compromise of confidentiality and integrity without requiring user interaction.

CVE-2026-93895 is a critical vulnerability in IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10. It allows an unauthenticated remote attacker to bypass access controls configured on gRPC service methods, potentially leading to unauthorized access to sensitive operations. The vulnerability has a high CVSS score of 9.1, indicating severe confidentiality and integrity impacts without requiring user interaction or privileges.

CVE-2026-95695 is a high-severity vulnerability in IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10. It involves incorrect authorization that could allow a remote attacker to bypass security restrictions without authentication. The vulnerability impacts confidentiality and integrity but does not affect availability. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.

CVE-2026-95696 is a medium severity vulnerability in IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10. It involves uncontrolled resource consumption caused by an uncaught exception, which could allow a remote attacker to cause a denial of service (DoS). The vulnerability does not impact confidentiality or integrity but affects availability. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.

CVE-2026-101294 is a high-severity vulnerability in IBM WebSphere Application Server - Liberty and IBM WebSphere Application Server versions 8.5 and 9.0. It involves a missing cryptographic step that allows a remote attacker to bypass cryptographic signature verification due to improper verification of the cryptographic signature. This flaw affects versions 17.0.0.3 through 26.0.0.10 of WebSphere Application Server - Liberty and versions 8.5 and 9.0 of WebSphere Application Server. The vulnerability has a CVSS 3.1 score of 8.7, indicating a high impact on confidentiality and integrity without requiring privileges or user interaction. No patch or remediation information is provided in the available data.

CVE-2026-105442 is a high-severity vulnerability in IBM WebSphere Application Server versions 8.5, 9.0, and Liberty editions from 17.0.0.3 through 26.0.0.10. It involves insecure deserialization of untrusted data in the messaging service, which could allow a remote attacker to cause a denial of service. The vulnerability does not impact confidentiality or integrity but affects availability.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10 suffer from insufficient isolation between servers sharing the same installation. This improper access control vulnerability can lead to high impact on confidentiality and integrity without user interaction. The vulnerability is tracked as CVE-2026-105443 and has a CVSS 3.1 score of 8.2, indicating high severity.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9 are affected by a privilege escalation vulnerability when the restConnector-2.0 feature is enabled. This vulnerability involves incorrect authorization, potentially allowing users with limited privileges to escalate their access rights. The CVSS v3.1 base score is 5.4, indicating a medium severity issue.

CVE-2026-14532 is an integer overflow or wraparound vulnerability in IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9. A user with Reader role privileges could exploit this flaw to obtain version information, which leads to an uncaught exception. The vulnerability has a medium severity rating with a CVSS score of 4.3. No information about available patches or vendor advisories is provided.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9 contain an information disclosure vulnerability (CWE-209) that allows an authenticated attacker to obtain sensitive information when the restConnector-2.0 feature is enabled. The vulnerability involves generation of error messages that expose sensitive data. The CVSS 3.1 base score is 6.5, indicating a medium severity issue.