Threats affecting pkg:maven/com.ibm.mq/mq

20 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	6.5	EPSS 0.3%	CVE-2026-14511IBM MQ · Unthrottled Resource Allocation Medium6.5EPSS 0.3%2026-10-19CVE Database V5CVE-2026-14511 CVE-2026-14511 is a vulnerability in IBM MQ versions 9.4.5.0 through 9.4.5.1 where an authenticated user can cause a denial of service by sending a specially crafted message that crashes consuming applications. EPSS 0.3%Vulnerability CWE-770	CVE Database V5	2026-10-19
High	8.8	EPSS 0.6%	CVE-2026-11725IBM MQ · Integer Overflow or Wraparound High8.8EPSS 0.6%2026-09-18CVE Database V5CVE-2026-11725 IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing. EPSS 0.6%Vulnerability CWE-190 #ghsa-w35j-3p8f-wphj	CVE Database V5	2026-09-18
High	8.8	EPSS 0.6%	CVE-2026-11378IBM MQ · Integer Overflow or Wraparound High8.8EPSS 0.6%2026-09-18CVE Database V5CVE-2026-11378 IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distribution list processing. EPSS 0.6%Vulnerability CWE-190 #ghsa-3qp5-vm6w-4rrg	CVE Database V5	2026-09-18
High	8.8	EPSS 0.6%	CVE-2026-11375IBM MQ · Heap-based Buffer Overflow High8.8EPSS 0.6%2026-09-18CVE Database V5CVE-2026-11375 IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a stack buffer overflow when processing XA transaction identifiers. EPSS 0.6%Vulnerability CWE-122 #ghsa-98w4-7mr5-93q9	CVE Database V5	2026-09-18
High	7.5	EPSS 0.5%	CVE-2026-10853IBM MQ · Unsafe Reflection High7.5EPSS 0.5%2026-09-18CVE Database V5CVE-2026-10853 IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths. EPSS 0.5%Vulnerability CWE-470 #ghsa-pwg9-6g7w-xg4q	CVE Database V5	2026-09-18
High	8.1	EPSS 0.8%	CVE-2026-10027IBM MQ · Out-of-bounds Write High8.1EPSS 0.8%2026-09-18CVE Database V5CVE-2026-10027 IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data on channels configured with compression enabled. EPSS 0.8%Vulnerability CWE-787 #ghsa-52gg-3863-7xg6	CVE Database V5	2026-09-18
High	8.1	EPSS 0.4%	CVE-2026-11728IBM MQ · Out-of-bounds Write High8.1EPSS 0.4%2026-09-15CVE Database V5CVE-2026-11728 CVE-2026-11728 is a high-severity vulnerability in IBM MQ affecting multiple versions including 9.1.0.0, 9.2.0.0, 9.3.0.0, 9.4.0.0, and 10.0.0.0. It involves a heap buffer overflow caused by an out-of-bounds write when the client receives messages from a malicious queue manager or via a man-in-the-middle attack. This flaw could allow a remote attacker to cause denial of service or potentially execute arbitrary code on the client. EPSS 0.4%Vulnerability CWE-787	CVE Database V5	2026-09-15
High	8.5	EPSS 0.5%	CVE-2026-11729IBM MQ · Deserialization of Untrusted Data High8.5EPSS 0.5%2026-09-15CVE Database V5CVE-2026-11729 CVE-2026-11729 is a high-severity vulnerability in IBM MQ affecting multiple versions from 9.1.0.0 through 10.0.0.0. It involves unsafe deserialization of untrusted data that can lead to JNDI injection attacks, allowing an authenticated attacker to execute arbitrary code in client applications. EPSS 0.5%Vulnerability CWE-502	CVE Database V5	2026-09-15
High	7.0	EPSS 0.2%	CVE-2026-12150IBM MQ · Stack-based Buffer Overflow High7.0EPSS 0.2%2026-09-15CVE Database V5CVE-2026-12150 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker with a trusted TLS client certificate to cause a denial of service and potentially affect memory contents due to improper validation of deeply nested certificate data during TLS certificate processing. EPSS 0.2%Vulnerability CWE-121	CVE Database V5	2026-09-15
Critical	9.8	EPSS 0.9%	CVE-2026-12351IBM MQ · Injection Critical9.8EPSS 0.9%2026-09-15CVE Database V5CVE-2026-12351 CVE-2026-12351 is a critical vulnerability in IBM MQ affecting versions 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0. It involves improper neutralization of special elements in output used by a downstream component, specifically unsafe JNDI lookup processing when the IVT application is deployed. This flaw could allow a remote attacker to execute arbitrary code on affected systems. EPSS 0.9%Vulnerability CWE-74	CVE Database V5	2026-09-15
High	7.5	EPSS 0.5%	CVE-2026-12354IBM MQ · Improper Control of Dynamically-Managed Code Resources High7.5EPSS 0.5%2026-09-15CVE Database V5CVE-2026-12354 CVE-2026-12354 is a high-severity vulnerability in IBM MQ affecting versions 9.1.0.0 through 10.0.0.0. It involves improper control of dynamically-managed code resources due to insufficient validation of JNDI names in the Resource Adapter Installation Verification Test application. This flaw could allow an authenticated attacker with low privileges to execute arbitrary code on the application server. EPSS 0.5%Vulnerability CWE-913	CVE Database V5	2026-09-15
High	8.1	EPSS 0.6%	CVE-2026-12355IBM MQ · Injection High8.1EPSS 0.6%2026-09-15CVE Database V5CVE-2026-12355 CVE-2026-12355 is a high-severity vulnerability in IBM MQ versions 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0. It involves improper neutralization of special elements in output used by a downstream component, enabling JNDI injection attacks. This vulnerability could lead to information disclosure or remote code execution if exploited. EPSS 0.6%Vulnerability CWE-74	CVE Database V5	2026-09-15
High	8.1	EPSS 0.5%	CVE-2026-12666IBM MQ · XML External Entity (XXE) High8.1EPSS 0.5%2026-09-15CVE Database V5CVE-2026-12666 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Classes for Java could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to XML external entity injection in MQRFH2 header processing. EPSS 0.5%Vulnerability CWE-611	CVE Database V5	2026-09-15
High	7.1	EPSS 0.3%	CVE-2026-12667IBM MQ · XML External Entity (XXE) High7.1EPSS 0.3%2026-09-15CVE Database V5CVE-2026-12667 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to read files from a vulnerable .NET client or cause limited denial of service due to improper handling of XML external entities in RFH2 folder parsing. EPSS 0.3%Vulnerability CWE-611	CVE Database V5	2026-09-15
High	8.8	EPSS 0.7%	CVE-2026-12728IBM MQ · Deserialization of Untrusted Data High8.8EPSS 0.7%2026-09-15CVE Database V5CVE-2026-12728 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code due to a deserialization of untrusted data. EPSS 0.7%Vulnerability CWE-502	CVE Database V5	2026-09-15
Medium	6.8	EPSS 0.4%	CVE-2026-13265IBM MQ · XML External Entity (XXE) Medium6.8EPSS 0.4%2026-09-14CVE Database V5CVE-2026-13265 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker with MFT publish authority to obtain sensitive information or cause a denial of service due to XML external entity injection in the mqweb MFT REST API. EPSS 0.4%Vulnerability CWE-611 #ghsa-5r5q-97h5-g9v3	CVE Database V5	2026-09-14
High	7.1	EPSS 0.3%	CVE-2026-13275IBM MQ · XML External Entity (XXE) High7.1EPSS 0.3%2026-09-14CVE Database V5CVE-2026-13275 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Managed File Transfer could allow an authenticated attacker to read arbitrary files or perform server-side request forgery due to XML external entity injection in reply message processing. EPSS 0.3%Vulnerability CWE-611 #ghsa-47qx-f7xv-mh34	CVE Database V5	2026-09-14
High	7.1	EPSS 0.5%	CVE-2026-13285IBM MQ · XML External Entity (XXE) High7.1EPSS 0.5%2026-09-14CVE Database V5CVE-2026-13285 IBM MQ is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. EPSS 0.5%Vulnerability CWE-611 #ghsa-6fjc-9pf3-r46v	CVE Database V5	2026-09-14
High	8.8	EPSS 0.8%	CVE-2026-13293IBM MQ · Deserialization of Untrusted Data High8.8EPSS 0.8%2026-09-14CVE Database V5CVE-2026-13293 IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote authenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data. EPSS 0.8%Vulnerability CWE-502 #ghsa-mqj8-gj7g-c998	CVE Database V5	2026-09-14
Medium	5.5	EPSS 0.1%	CVE-2026-1713IBM MQ · Authentication Bypass by Primary Weakness Medium5.5EPSS 0.1%2026-03-03CVE Database V5CVE-2026-1713 IBM MQ 9.1.0.0 through 9.1.0.33 LTS, 9.2.0.0 through 9.2.0.40 LTS, 9.3.0.0 through 9.3.0.36 LTS, 9.30.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.17 LTS, and 9.4.0.0 through 9.4.4.1 CD EPSS 0.1%Vulnerability CWE-305	CVE Database V5	2026-03-03

Page 1 of 1