EUVD-2026-83037

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in distribution list processing...

CVE-2026-11375

IBM MQ (Server component) and IBM MQ Appliance are affected by a stack buffer overflow triggered when processing XA transaction identifiers , allowing an authenticated remote attacker to cause denial of service or potentially execute arbitrary code (CVSS 8.8, CWE-122). Affected versions span IBM ...

CVE-2026-10858

CVE-2026-10858 is a heap buffer underflow in the IBM MQ queue manager's protocol handling, triggered when processing multi-segment messages . An authenticated remote attacker can cause a denial of service or potentially execute arbitrary code . IBM rates it CVSS 3.1: 9.9 (Critical) with changed s...

CVE-2026-10858 IBM MQ for HPE NonStop is vulnerable to a denial of service attack

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages...

CVE-2026-10858 IBM MQ for HPE NonStop is vulnerable to a denial of service attack

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer underflow when processing multi-segment messages...

MAL-2026-16289 Malicious code in test890-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a873f4ca1e603a5d6dc6d888de73a7f2c766a66af13f56a49538034e1e8706fd On npm install, index.js runs as a preinstall script and collects installer-side identifiers - home directory path, hostname, username, configured DN...

MAL-2026-16288 Malicious code in test89-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2b8794dc6672c38596cd891ce414dc2bce8c9db38cd8e08afc51b411415639e [email protected] runs node index.js from its preinstall lifecycle hook. On npm install, index.js collects host identity hostname, whoami, id, uname...

EUVD-2026-83021

IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applications due to a deserialization filter bypass in exception handling...

CVE-2026-10747 IBM MQ Appliance is affected by a heap buffer overflow vulnerability in protocol message processing

IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message processing before authentication...

EUVD-2026-83018

IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow in protocol message processing before authentication...

EUVD-2026-83129

IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data on channels configured with compression enabled...

CVE-2026-10027

IBM MQ and IBM MQ Appliance are vulnerable to a heap out-of-bounds write (CWE-787 ) when processing malformed compressed data on channels with compression enabled. This vulnerability could allow an unauthenticated remote attacker with network access to the listener port to execute arbitrary code ...

CVE-2025-36076

IBM Cognos Analytics versions 12.1.0 through 12.1.3 FP1 and 12.0.4 through 12.0.4 FP2 are affected by a vulnerability where sensitive information is stored in source code (CWE-540). An authenticated user can access this information, potentially using it in further attacks against the system. The ...

CVE-2025-36076 IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated user in further attacks against the system...

EUVD-2025-210957

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated user in further attacks against the system...

CVE-2025-36076 IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated user in further attacks against the system...

Improper Control of Dynamically-Managed Code Resources

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources via a sloppy-mode host function invoked from the sandbox with a nullish receiver. When sandbox...

Improper Control of Dynamically-Managed Code Resources

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources via the Promise @@species constructor lookup in lib/bridge.js. When sandbox code invokes then,...

Improper Control of Dynamically-Managed Code Resources

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources via the NodeVM builtin module denylist in lib/builtin.js, which omits childprocess from...

MAL-2026-16285 Malicious code in test899-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64702ec2b2b0fcc5ec6eb56e8ca63fc94d3ff54fdcd45509fcc9640ccbbffdcf On npm install, the package's preinstall hook executes index.js which collects installer host and identity information hostname, platform, OS release...