IBM has disclosed five CVEs affecting IBM MQ and MQ Operator that could allow denial of service or code execution. IBM, as the CNA, rates three at 8.8, one at 8.1 and one at 7.5 under CVSS 3.1.
Heap buffer overflows enable code execution.
CVE-2026-12148 stems from unrestricted Java deserialization in MQ Classes for Java and carries IBM CNA 3.1 7.5.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms, tracked as CVE-2026-6719. IBM, as the CNA, rates it 7.5 under CVSS 3.1. NVD has not scored it.
IBM Cloud Pak System 2.3.6.0 and 2.3.6.1 have a stored cross-site scripting flaw, CVE-2026-3295. IBM, as the CNA, rates it 7.4 under CVSS 3.1.
D-Link E15, M32, R15 and R32 routers have a hard-coded credential flaw (CVE-2026-112146) in the MQTT Broker. The CNA rated it 7.4 under CVSS 3.1, and a proof-of-concept exploit is public. No fix has been reported.
CISA added AhsayCBS flaws CVE-2026-105134 and CVE-2026-105133 to its Known Exploited Vulnerabilities catalog on October 14, with an October 17 deadline for federal agencies. Attackers are chaining them to plant webshells and cryptominers, and Ahsay says its first patches did not fully fix them.
bbs-go through 4.4.6 has a Google One Tap login flaw (CVE-2026-111639) that skips ID-token audience checks, letting attackers replay tokens from any OAuth client to take over Google-linked accounts. VulnCheck rates it 8.1 (CVSS 3.1) and 8.6 (CVSS 4.0).
