Login Request a demo
MQ
Product
MQ
by IBM · last CVE Oct 19, 2026
81
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities81In the news0Timeline
Severity mix
Critical 4High 37Medium 39Low 1
Severity
All severities81Critical4High37Medium39Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add MQ to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-13265
6.8
0%
Sep 14
IBM MQ Managed File Transfer REST API is vulnerable to XML external entity injection
Affected: 9.1.0.0 through 9.1.0.37 LTS; 9.2.0.0 through 9.2.0.43 LTS; 9.3.0.0 through 9.3.0.41 LTS; 9.3.0.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.25 LTS; 9.4.0.0 through 9.4.5.1 CD; +1 more
CVE-2026-14511
6.5
0%
Oct 19
IBM MQ Denial of Service
Affected: 9.4.5.0 through 9.4.5.1
CVE-2025-23225
6.5
0%
Feb 28
IBM MQ denial of service
Affected: 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD
CVE-2024-51470
6.5
1%
Dec 18
IBM MQ denial of service
Affected: 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD
CVE-2024-35156
6.5
1%
Jun 28
IBM MQ information disclosure
Affected: 9.3.0.0 before 9.3.0.20; 9.3.0.0 before 9.4.0.0
CVE-2024-35155
6.5
1%
Jun 28
IBM MQ information disclosure
Affected: 9.3.0; 9.3.0
CVE-2022-43919
6.5
1%
May 5
IBM MQ denial of service
Affected: 9.2 CD, 9.2 LTS, 9.3 CD, 9.3 LTS
CVE-2022-31772
6.5
1%
Nov 11
IBM MQ 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS, 9.2 CD, and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service to the MQTT channels
Affected: 8.0.0.0; 9.0.0.0; 9.1.0; 9.1.0.0; 9.2.0; 9.2.0
CVE-2021-38875
6.5
1%
Nov 23
IBM MQ 8.0, 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.1 CD, and 9.2 CD is vulnerable to a denial of service attack caused by an error processing messages
Affected: 8.0.0.0; 9.0.0.0; 9.1.0; 9.1.0.0; 9.2.0; 9.2.0
CVE-2020-4931
6.5
1%
Feb 24
IBM MQ 9.1 LTS, 9.2 LTS, and 9.1 CD AMQP Channels could allow an authenticated user to cause a denial of service due to an issue processing messages
Affected: 9.1.0; 9.1.0.0; 9.2.0.0
CVE-2020-4320
6.5
1%
Jun 16
IBM MQ Appliance and IBM MQ AMQP Channels 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD do not correctly block or allow clients based on the certificate distinguished name SSLPEER setting
Affected: 8.0.0.0 before 8.0.0.15; 9.0.0.0 before 9.0.0.10; 9.1.0 before 9.1.5; 9.1.0.0 before 9.1.0.5
CVE-2020-4267
6.5
1%
Apr 24
IBM MQ and MQ Appliance 8.0, 9.1 LTS, and 9.1 CD could allow an authenticated user cause a denial of service due to a memory leak
Affected: 8.0.0.0 before 8.0.0.14; 9.1.0.0 before 9.1.0.4
CVE-2019-4656
6.5
1%
Mar 16
IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD is vulnerable to a denial of service attack that would allow an authenticated user to crash the queue and…
Affected: 8.0.0.0 before 8.0.0.14; 9.0.0.0 through 9.0.0.9; 9.1.0 before 9.1.4; 9.1.0.0 before 9.1.0.4
CVE-2019-4614
6.5
2%
Jan 28
IBM MQ and IBM MQ Appliance 8.0 and 9.0 LTS client connecting to a Queue Manager could cause a SIGSEGV denial of service caused by converting an invalid message
Affected: 8.0.0.0 before 8.0.0.14; 9.0.0.0 before 9.0.0.8; 9.1.0 before 9.1.4; 9.1.0.0 before 9.1.0.4
CVE-2019-4378
6.5
1%
Sep 26
IBM MQ 7.5.0.0 - 7.5.0.9, 7.1.0.0 - 7.1.0.9, 8.0.0.0 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 command server is vulnerable to a denial of service attack…
Affected: 7.1.0.0 through 7.1.0.9; 7.5.0.0 through 7.5.0.9; 8.0.0.0 through 8.0.0.12; 9.0.0.0 through 9.0.0.6; 9.1.0.0 through 9.1.2.0
CVE-2019-4261
6.5
2%
Aug 5
IBM WebSphere MQ V7.1, 7.5, IBM MQ V8, IBM MQ V9.0LTS, IBM MQ V9.1 LTS, and IBM MQ V9.1 CD are vulnerable to a denial of service attack caused by specially crafted messages
Affected: 8.0.0.0 through 8.0.0.11; 9.0.0.0 through 9.0.0.6; 9.1.0 through 9.1.2; 9.1.0.0 through 9.1.0.2
CVE-2024-52898
6.2
0%
Jan 14
IBM MQ information disclosure
Affected: 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD
CVE-2024-52897
6.2
0%
Dec 19
IBM MQ information disclosure
Affected: 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD
CVE-2024-52896
6.2
0%
Dec 19
IBM MQ information disclosure
Affected: 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD
CVE-2023-26285
5.9
1%
May 5
IBM MQ denial of service
Affected: 9.2 CD, 9.2 LTS, 9.3 CD, 9.3 LTS
CVE-2019-4568
5.9
1%
Jan 28
IBM MQ and IBM MQ Appliance 8.0 and 9.0 LTS could allow a remote attacker with intimate knowledge of the server to cause a denial of service when receiving data on the channel
Affected: 8.0.0.0 before 8.0.0.14; 9.0.0.0 before 9.0.0.8
CVE-2025-36100
5.5
0%
Sep 7
IBM MQ information disclosure
Affected: 9.1.0.0 through 9.1.0.29; 9.2.0.0 through 9.2.0.36; 9.3.0.0 through 9.3.0.30; 9.4.0.0 through 9.4.0.12; 9.3.0.0 through 9.3.5.1; 9.4.0.0 through 9.4.3.0
CVE-2025-0985
5.5
0%
Feb 28
IBM MQ information disclosure
Affected: 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD
CVE-2024-54175
5.5
0%
Feb 28
IBM MQ denial of service
Affected: 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD
CVE-2023-28950
5.5
0%
May 19
IBM MQ information disclosure
Affected: 8.0, 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.2 CD, 9.3 LTS, 9.3 CD
CVE-2023-28514
5.5
0%
May 19
IBM MQ information disclosure
Affected: 8.0, 9.0 LTS, 9.0 CD, 9.1 LTS
CVE-2023-22874
5.5
0%
May 5
IBM MQ denial of service
Affected: 9.2 CD, 9.3 CD, and 9.3 LTS
CVE-2022-22321
5.5
0%
Mar 1
IBM MQ Appliance 9.2 CD and 9.2 LTS local messaging users stored with a password hash that provides insufficient protection
Affected: 9.2.0 before 9.2.0.5; 9.2.0 before 9.2.5
CVE-2021-38949
5.5
0%
Nov 16
IBM MQ 7.5, 8.0, 9.0 LTS, 9.1 CD, and 9.1 LTS stores user credentials in plain clear text which can be read by a local user
Affected: 8.0.0.0 before 8.0.0.14; 9.0.0.0 before 9.0.0.9; 9.1.0 before 9.1.5; 9.1.0.0 before 9.1.0.5
CVE-2020-4338
5.5
0%
Apr 16
IBM MQ 9.1.4 could allow a local attacker to obtain sensitive information by inclusion of sensitive data within runmqras data
Affected: 9.1.0 before 9.1.5
CVE-2019-4719
5.5
0%
Mar 16
IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within runmqras…
Affected: 8.0.0.0 before 8.0.0.14; 9.0.0.0 through 9.0.0.9; 9.1.0 before 9.1.4; 9.1.0.0 before 9.1.0.4
CVE-2019-4619
5.5
0%
Mar 16
IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace
Affected: 8.0.0.0 before 8.0.0.14; 9.0.0.0 through 9.0.0.9; 9.1.0 before 9.1.4; 9.1.0.0 before 9.1.0.4
CVE-2019-4049
5.5
0%
Aug 20
IBM MQ 9.1.0.0, 9.1.0.1, 9.1.1, and 9.1.0.2 is vulnerable to a denial of service due to a local user being able to fill up the disk space of the underlying filesystem using the…
Affected: 9.1.0 through 9.1.1; 9.1.0.0 through 9.1.0.2
CVE-2021-38986
5.4
0%
Mar 1
IBM MQ Appliance 9.2 CD and 9.2 LTS does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system
Affected: 9.2.0 before 9.2.0.4; 9.2.0 before 9.2.5
CVE-2018-1836
5.4
1%
Mar 19
IBM WebSphere MQ 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.1.0.0, and 9.1.0.1 console is vulnerable to cross-site scripting
Affected: 9.0.2; 9.0.3; 9.0.4; 9.0.5; 9.1.0.0; 9.1.0.1
CVE-2023-45177
5.3
1%
Mar 20
IBM MQ denial of service
Affected: 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD
CVE-2026-1713
5.0
0%
Mar 3
IBM MQ is affected by an authority vulnerablility
Affected: 9.1.0.0 through 9.1.0.33 LTS; 9.2.0.0 through 9.2.0.40 LTS; 9.3.0.0 through 9.3.0.36 LTS; 9.30.0 through 9.3.5.1 CD; 9.4.0.0 through 9.4.0.17 LTS; 9.4.0.0 through 9.4.4.1 CD
CVE-2024-54173
4.7
0%
Feb 28
IBM MQ information disclosure
Affected: 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD
CVE-2019-4655
4.3
1%
Dec 30
IBM MQ 9.1.0.0, 9.1.0.1, 9.1.0.2, 9.1.0.3, 9.1.1, 9.1.2, and 9.1.3 is vulnerable to a denial of service attack that would allow an authenticated user to reset client connections…
Affected: 9.1.0 before 9.1.4; 9.1.0.0 before 9.1.0.4
Showing 39