BaselineWatch
58357 CVEs · 127 in KEV
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in
CVEs known58,357 New, 24 h1,170 Changed, 24 h1,887 In KEV127 Public exploit1,578 Match watchlist0

Vulnerabilities

All My stack Known exploited Public exploit Critical (9+) Likely exploited (EPSS ≥ 50%) Changed, 24 h New, 24 h Sort: risk modified published CVSS EPSS
CVECVSSEPSSVendor, productDescriptionModified
CVE-2026-12665 9.8 critical 0.00% ibm, mq_operator, supplied_mq_advanced_container_images IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment. Fri 23 Oct
CVE-2026-12148 8.8 high 0.00% ibm, mq_operator, supplied_mq_advanced_container_images IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java. Fri 23 Oct
CVE-2026-10572 8.8 high 0.00% ibm, mq_operator, supplied_mq_advanced_container_images IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options. Fri 23 Oct
CVE-2026-10574 8.8 high 0.00% ibm, mq_operator, supplied_mq_advanced_container_images IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties. Fri 23 Oct
CVE-2026-10743 8.8 high 0.00% ibm, mq_operator, supplied_mq_advanced_container_images IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations. Fri 23 Oct
CVE-2026-12155 6.5 medium 0.00% ibm, mq_operator, supplied_mq_advanced_container_images IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigger a NULL pointer dereference. Fri 23 Oct
CVE-2026-11829 6.5 medium 0.00% ibm, mq_operator, supplied_mq_advanced_container_images IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of offset values in MQOPEN requests. Fri 23 Oct
CVE-2026-12343 6.5 medium 0.00% ibm, mq_operator, supplied_mq_advanced_container_images IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe operations. Fri 23 Oct
CVE-2026-12350 6.5 medium 0.00% ibm, mq_operator, supplied_mq_advanced_container_images IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process. Fri 23 Oct
CVE-2026-12670 6.5 medium 0.00% ibm, mq_operator, supplied_mq_advanced_container_images IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive memory operations during character set conversion. Fri 23 Oct
CVE-2026-11828 5.9 medium 0.00% ibm, mq_operator, supplied_mq_advanced_container_images IBM MQ could allow a remote attacker with queue manager control or man-in-the-middle access on unencrypted channels to cause a denial of service in client applications using asynchronous message consumption due to improper validation of queue name length values. Fri 23 Oct
CVE-2026-11831 5.4 medium 0.00% ibm, mq_operator, supplied_mq_advanced_container_images IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request. Fri 23 Oct
CVE-2026-2607 5.1 medium 0.00% no CPE yet IBM MQ Operator SC2: v3.2.0 through 3.2.23CD: v3.3.0, v3.4.0, v3.4.1, v3.5.0, v3.5.1 - v3.5.3, v3.6.0 - v3.6.4, v3.7.0 - v3.7.2, v3.8.0, v3.8.1, v3.9.0, v3.9.1LTS: v2.0.0 - 2.0.29 and IBM supplied MQ Advanced container images SC2: 9.4.0.6 through r1, 9.4.0.6-r2, 9.4.0.7-r1, 9.4.0.10-r1, 9.4.0.10-r2, 9.4.0.11-r1, 9.4.0.11-r2, 9.4.0.11-r3, 9.4.0.12-r1, 9.4.0.15-r1 - 9.4.0.15-r4, 9.4.0.16-r1, 9.4.0.16-r2, 9.4.0.17-r1, 9.4.0.17-r2, 9.4.0.20-r1CD: 9.4.1.0-r1, 9.4.1.0-r2, 9.4.1.1-r1, 9.4.2.0-r1, 9.4.2.0-r2, 9.4.2.1-r1, 9.4.2.1-r2, 9.4.3.0-r1, 9.4.3.0-r2, 9.4.3.1-r1 - 9.4.3.1-r3, 9.4.4.0-r1 - 9.4.4.0-r4, 9.4.4.1-r1, 9.4.5.0-r1, 9.4.5.0-r2LTS: 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1, 9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2, 9.3.0.5-r3, 9.3.0.6-r1, 9.3.0.10-r1, 9.3.0.10-r2, 9.3.0.11-r1,9.3.0.11-r2, 9.3.0.15-r1, 9.3.0.16-r1, 9.3.0.16-r2, 9.3.0.17-r1, 9.3.0.17-r2, 9.3.0.17-r3, 9.3.0.20-r1, 9.3.0.20-r2, 9.3.0.21-r1, 9.3.0.21-r2, 9.3.0.21-r3, 9.3.0.25-r1, 9.4.0.0-r1, 9.4.0.0-r2, 9.4.0.0-r3, 9.4.0.5-r1, 9.4.0.5-r2 IBM MQ stores potentially sensitive information in log files that could be read by a local user. Mon 26 Oct
CVE-2026-12669 4.3 medium 0.00% ibm, mq_operator, supplied_mq_advanced_container_images IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected. Fri 23 Oct
CVE-2026-12727 4.3 medium 0.00% ibm, mq_operator, supplied_mq_advanced_container_images IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing specially crafted object names. Fri 23 Oct
CVE-2026-12660 2.7 low 0.00% ibm, mq_operator, supplied_mq_advanced_container_images IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation. Fri 23 Oct

16 of 16

Download these 16 as CSV · subscribe to this list.

EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.