VulnFeed.org: IBM MQhttps://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enCVE-2026-13289: IBM MQ Managed File Transfer is vulnerable to XML external entity injectionhttps://vulnfeed.org/cve/CVE-2026-13289/https://vulnfeed.org/cve/CVE-2026-13289/Wed, 04 Nov 2026 21:18:12 +0000IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.CVE-2026-13292: IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerabilityhttps://vulnfeed.org/cve/CVE-2026-13292/https://vulnfeed.org/cve/CVE-2026-13292/Wed, 04 Nov 2026 21:18:12 +0000IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code by injecting malicious environment variables through transfer request metadata.CVE-2026-12356: IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerabilityhttps://vulnfeed.org/cve/CVE-2026-12356/https://vulnfeed.org/cve/CVE-2026-12356/Wed, 04 Nov 2026 21:18:11 +0000IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated user with command queue access to execute arbitrary code by injecting malicious arguments into Ant script commands.CVE-2026-13271: IBM MQ Managed File Transfer is affected by a denial of service vulnerabilityhttps://vulnfeed.org/cve/CVE-2026-13271/https://vulnfeed.org/cve/CVE-2026-13271/Wed, 04 Nov 2026 21:18:11 +0000IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD Managed File Transfer could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper restriction of XML external entity references in command queue processing.CVE-2026-13284: IBM MQ Managed File Transfer is vulnerable to XML external entity injectionhttps://vulnfeed.org/cve/CVE-2026-13284/https://vulnfeed.org/cve/CVE-2026-13284/Wed, 04 Nov 2026 21:18:11 +0000IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.CVE-2026-11376: IBM MQ is affected by a denial of service vulnerabilityhttps://vulnfeed.org/cve/CVE-2026-11376/https://vulnfeed.org/cve/CVE-2026-11376/Wed, 04 Nov 2026 21:17:56 +0000IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow when processing subscription requests with crafted buffer size values.CVE-2026-11724: IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerabilityhttps://vulnfeed.org/cve/CVE-2026-11724/https://vulnfeed.org/cve/CVE-2026-11724/Wed, 04 Nov 2026 21:17:56 +0000IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on a Managed File Transfer agent host due to improper validation of metadata used during script execution.CVE-2026-10859: IBM MQ XMS .NET client is affected by an arbitrary code execution vulnerabilityhttps://vulnfeed.org/cve/CVE-2026-10859/https://vulnfeed.org/cve/CVE-2026-10859/Wed, 04 Nov 2026 21:17:48 +0000IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads.CVE-2026-18142: IBM MQ is affected by a denial of service vulnerabilityhttps://vulnfeed.org/cve/CVE-2026-18142/https://vulnfeed.org/cve/CVE-2026-18142/Wed, 04 Nov 2026 20:21:55 +0000IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow a remote authenticated attacker to cause a denial of service and perform limited memory corruption due to an integer overflow.