Known vulnerabilities in IBM MQ
Vendor:
IBM Corporation
Software:
IBM MQ
Software CPE:
cpe:2.3:a:ibm_corporation:ibm_mq:*:*:*:*:*:*:*:*
Website:
https://www.ibm.com/us-en
Total vulnerabilities:
209
Public exploits:
6
Known exploited (KEV):
2
Highest CVSSv4 Score:
9.4
Breakdown by Severity Chart
9.3.0.41
9.2.0.43
9.1.0.37
9.4.0.21
9.3.0.40
9.2.0.42
9.1.0.36
9.4.5.1
9.4.0.19
9.4.0.18
9.4.0.20
9.3.0.37
9.1.0.34
9.2.0.41
9.4.4.0
9.4.0.16
9.4.0.15
9.4.0.14
9.4.0.13
9.4.0.12
9.4.0.11
9.4.0.9
9.4.0.8
9.3.0.35
9.3.0.34
9.3.0.33
9.3.0.32
9.3.0.31
9.3.0.30
9.3.0.29
9.3.0.28
9.2.0.40
9.2.0.39
9.2.0.38
9.2.0.37
9.2.0.36
9.2.0.35
9.2.0.34
9.2.0.33
9.2.0.32
9.1.0.28
9.1.0.29
9.1.0.30
9.1.0.31
9.1.0.32
9.1.0.33
9.3.0.36
9.4.0.17
9.4.4.1
9.4.0.10
9.3.0.27
9.2.0.31
9.1.0.27
9.4.2
8.0.0.16 SU2
1.8.2 CD
1.3.4 EUS
9.2.0.30
9.2.0.29
9.2.0.24
9.2.0.23
9.2.0.19
9.2.0.18
9.2.0.17
9.2.0.14
9.2.0.13
9.2.0.12
9.3.0.24
9.3.0.23
9.3.0.22
9.3.0.19
9.3.0.18
9.3.0.14
9.3.0.13
9.3.0.12
9.3.0.9
9.3.0.8
9.3.0.7
9.4.0.4
9.4.0.3
9.4.0.2
9.4.0.1
9.4.0.0
9.4.1.1
9.3.0.26
9.1.0.26
9.4.0.7
9.4.0.6
9.3.0.25
9.2.0.28
9.1.0.24
9.4.1
9.4.0.5
9.3.0.21
9.2.0.27
9.1.0.23
9.0.0.27
9.3.5.2
9.3.0.20 FixPack
9.0.0.25
9.0.0.26
9.2.0.26
9.4
9.3.0.20
9.1.0.22
9.3.5.1
9.3.0.17
9.2.0.25
9.1.0.21
9.0.0.24
9.3.0
9.3.0.16
9.3.5
9.2.0.22
9.1.0.20
9.0.0.23
7.5.0.9
9.2
9.1
9.0
9.3.4.1
9.3.0.15
9.2.0.21
9.1.0.19
9.0.0.22
9.3.4
9.3.0.11
9.2.0.20
9.1.0.18
9.0.0.21
9.3.3.1
9.3.0.10
9.2.0.16
9.1.0.17
9.0.0.19
9.3.3
9.3.0.6
9.2.0.15
9.1.0.16
9.0.0.18
9.3.0.5-r3
9.3.2.1
9.0.0.17
9.2.0.11
9.3.0.5
9.0.0.15
9.3.2.0
9.3.0.3
9.3.0.4
9.0.0.16
9.3.0.0
9.2.0.10
9.2.0.9
9.2.0.8
9.1.0.13
9.0.0.14
9.3.1.1
9.3.1.0
9.3.0.2
9.2.0.7
9.3.1
9.3.0.1
9.1.0.12
9.3
9.2.0.6
9.2.0.1
9.2.0.2
9.2.0.3
9.2.0.4
9.2.4 CD
9.2.0.5
9.2.5 CD
9.2 IT40099
9.1.0.11
9.1.0.10
9.1.0.9
9.1.0.8
9.1.0.7
9.1.0.6
9.1.0.5
9.1.0.4
9.1.0.3
9.1.0.2
9.0.0.13
9.0.0.12
9.0.0.11
9.0.0.10
9.0.0.9
9.0.0.8
9.0.0.7
9.0.0.6
9.0.0.0
8.0.0.16
8.0.0.15
8.0.0.14
8.0.0.13
8.0.0.12
8.0.0.11
9.2.1.0
9.2.0.0
9.1.5.0
9.1.3.0
9.1.2.0
9.1.1.0
9.0.5.0
9.2.2.0
9.1.4.0
9.1.1
9.1.0.1
5.3.1.15
9.1.0.0
9.0.0.5
9.0.0.4
8.0.0.10
7.1.0.9
8.0.0.9
7.0.1.14
7.0.1.13
9.0.0.3
9.0.4
9.0.0.2
8.0.0.8
8.0.0.7
7.5.0.8
9.0.0.1
9.0.5
8.0.0.6
8.0.0.5
7.5.0.7
7.5.0.6
7.1.0.8
7.1.0.7
9.0.3
9.0.2
9.0.1
9.0.0
8.0.0.4
7.1.0.6
7.5.0.5
8.0.0.3
8.0.0.2
8.0
8.0.0.1
7.0.1.12
7.0.1.11
7.1.0.5
7.5.0.4
8.0.0.0
7.5.0.3
7.1.0.3
7.1.0.4
7.5.0.2
7.0.1.9
7.5.0.1
7.1.0.2
7.1.0.1
7.0.1.10
7.0.4
7.0.4.0
7.0.2.2
7.0.2.0
7.0.1.6
7.0.1.7
7.5
7.0.1.5
7.1
7.0.1.8
7.0.1.4
6.0.2.9
6.0.2.8
7.0.1.2
7.0.1.3
7.0.1
7.0.0
7.0.1.1
7.0.1.0
7.0.0.0
6.0.2.7
6.0.2.10
7.0.0.2
6.0.2.5
6.0.2.6
6.0.1.0
6.0.2.1
6.0.0.0
6.0.1.1
7.0.0.1
6.0.2.3
7.0
6.0.2.2
6.0.2.4
5.1
5.3.1
6
5.3
6.0.2.0
6.0
Vulnerabilities (209)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU124833 - Server-Side Request Forgery (SSRF) CVE-2026-1561 |
CWE-918 | Low | 9.1.0.36, 9.2.0.42, 9.3.0.40, 9.4.0.21 | 02.04.2026 |
SB2026040252 SB2026040325 SB2026040331 and 9 more |
||
| #VU124831 - Weak Password Requirements CVE-2025-14917 |
CWE-521 | Low | 9.1.0.36, 9.2.0.42, 9.3.0.40, 9.4.0.21, 9.4.5.1 | 02.04.2026 |
SB2026040252 SB2026040327 SB2026040328 and 12 more |
||
| #VU124829 - Exposure of sensitive information to an unauthorized actor CVE-2025-14915 |
CWE-200 | Low | 9.1.0.36, 9.2.0.42, 9.3.0.40, 9.4.0.21, 9.4.5.1 | 02.04.2026 |
SB2026040252 SB2026040326 SB2026040329 and 9 more |
||
| #VU123913 - Improper Access Control CVE-2024-29371 |
CWE-284 | Medium | 9.1.0.36, 9.2.0.42, 9.3.0.40, 9.4.0.21, 9.4.5.1 | 12.03.2026 |
SB2026031212 SB2026031213 SB2026031310 and 27 more |
||
| #VU123159 - Incorrect Calculation of Buffer Size CVE-2026-1188 |
CWE-131 | High | 9.1.0.36, 9.2.0.42, 9.3.0.40, 9.4.5.1 | 24.02.2026 |
SB2026022412 SB2026022413 SB2026022531 and 46 more |
||
| #VU122748 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2025-14914 |
CWE-22 | Low | 9.1.0.34, 9.2.0.41, 9.3.0.37, 9.4.0.20, 9.4.5.1 | 12.02.2026 |
SB2026021209 SB2026021210 SB2026021212 and 22 more |
||
| #VU122086 - Type confusion CVE-2026-22796 |
CWE-843 | Medium | 9.1.0.34, 9.2.0.41, 9.3.0.37, 9.4.0.20 | 27.01.2026 |
SB2026012785 SB2026012791 SB2026012792 and 50 more |
||
| #VU122085 - NULL Pointer Dereference CVE-2026-22795 |
CWE-476 | Medium | 9.1.0.34, 9.2.0.41, 9.3.0.37, 9.4.0.20 | 27.01.2026 |
SB2026012785 SB2026012791 SB2026012792 and 47 more |
||
| #VU122084 - NULL Pointer Dereference CVE-2025-69421 |
CWE-476 | Medium | 9.1.0.34, 9.2.0.41, 9.3.0.37, 9.4.0.20 | 27.01.2026 |
SB2026012785 SB2026012791 SB2026012792 and 49 more |
||
| #VU122083 - Type confusion CVE-2025-69420 |
CWE-843 | Medium | 9.1.0.34, 9.2.0.41, 9.3.0.37, 9.4.0.20 | 27.01.2026 |
SB2026012785 SB2026012791 SB2026012792 and 48 more |
||
| #VU122082 - Out-of-bounds write CVE-2025-69419 |
CWE-787 | Low | 9.1.0.34, 9.2.0.41, 9.3.0.37, 9.4.0.20 | 27.01.2026 |
SB2026012785 SB2026012791 SB2026012792 and 68 more |
||
| #VU122081 - Cleartext Transmission of Sensitive Information CVE-2025-69418 |
CWE-319 | Low | 9.1.0.34, 9.2.0.41, 9.3.0.37, 9.4.0.20 | 27.01.2026 |
SB2026012785 SB2026012791 SB2026012792 and 45 more |
||
| #VU122080 - Out-of-bounds write CVE-2025-68160 |
CWE-787 | Medium | 9.1.0.34, 9.2.0.41, 9.3.0.37, 9.4.0.20 | 27.01.2026 |
SB2026012785 SB2026012791 SB2026012792 and 48 more |
||
| #VU122079 - Resource exhaustion CVE-2025-66199 |
CWE-400 | Medium | 9.1.0.34, 9.2.0.41, 9.3.0.37, 9.4.0.20 | 27.01.2026 |
SB2026012785 SB2026012791 SB2026012792 and 16 more |
||
| #VU122078 - Numeric Truncation Error CVE-2025-15469 |
CWE-197 | Low | 9.1.0.34, 9.2.0.41, 9.3.0.37, 9.4.0.20 | 27.01.2026 |
SB2026012785 SB2026012791 SB2026012792 and 13 more |
||
| #VU122077 - NULL Pointer Dereference CVE-2025-15468 |
CWE-476 | Medium | 9.1.0.34, 9.2.0.41, 9.3.0.37, 9.4.0.20 | 27.01.2026 |
SB2026012785 SB2026012791 SB2026012792 and 17 more |
||
| #VU121727 - Improper input validation CVE-2026-21945 |
CWE-20 | Medium | 9.1.0.36, 9.2.0.42, 9.3.0.40, 9.4.5.1 | 20.01.2026 |
SB20260120152 SB20260120153 SB20260120154 and 96 more |
||
| #VU121728 - Improper input validation CVE-2026-21932 |
CWE-20 | Medium | 9.1.0.36, 9.2.0.42, 9.3.0.40, 9.4.5.1 | 20.01.2026 |
SB20260120152 SB20260120153 SB20260120154 and 77 more |
||
| #VU121729 - Improper input validation CVE-2026-21933 |
CWE-20 | Medium | 9.1.0.36, 9.2.0.42, 9.3.0.40, 9.4.5.1 | 20.01.2026 |
SB20260120152 SB20260120153 SB20260120154 and 89 more |
||
| #VU121730 - Out-of-bounds read CVE-2026-21925 |
CWE-125 | Medium | 9.1.0.36, 9.2.0.42, 9.3.0.40, 9.4.5.1 | 20.01.2026 |
SB20260120152 SB20260120153 SB20260120154 and 91 more |
Showing elements 1 - 20 out of 209