← Back

Websphere Application Server

websphere_application_server

Vendor: Ibm • 465 CVEs

CVEs (465)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2026-11541
1Ibm
1Websphere Application Server
Jul 2, 2026
Jun 30, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.
CVE-2026-11594
1Ibm
1Websphere Application Server
Jul 2, 2026
Jun 30, 2026
N/A· v4
6.1 MEDIUM· v3
N/A· v2
IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console.
CVE-2026-11806
1Ibm
1Websphere Application Server
Jul 2, 2026
Jun 30, 2026
N/A· v4
7.5 HIGH· v3
N/A· v2
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.
CVE-2026-11714
1Ibm
1Websphere Application Server
Jul 2, 2026
Jun 30, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled.
CVE-2026-11712
1Ibm
1Websphere Application Server
Jul 2, 2026
Jun 30, 2026
N/A· v4
9.3 CRITICAL· v3
N/A· v2
IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system.
CVE-2026-11708
1Ibm
1Websphere Application Server
Jul 2, 2026
Jun 30, 2026
N/A· v4
9.3 CRITICAL· v3
N/A· v2
IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system.
CVE-2026-11595
1Ibm
1Websphere Application Server
Jul 2, 2026
Jun 30, 2026
N/A· v4
7.5 HIGH· v3
N/A· v2
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the administrative console's integrated help system.
CVE-2026-11546
1Ibm
1Websphere Application Server
Jul 2, 2026
Jun 30, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.
CVE-2026-9320
1Ibm
1Websphere Application Server
Jun 23, 2026
Jun 22, 2026
N/A· v4
7.5 HIGH· v3
N/A· v2
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attack...Show more
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.Show less
CVE-2026-9071
1Ibm
1Websphere Application Server
Jun 23, 2026
Jun 22, 2026
N/A· v4
7.5 HIGH· v3
N/A· v2
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attack...Show more
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.Show less
CVE-2026-9006
1Ibm
1Websphere Application Server
Jun 24, 2026
Jun 22, 2026
N/A· v4
9.1 CRITICAL· v3
N/A· v2
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a s...Show more
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure.Show less
CVE-2026-8646
1Ibm
1Websphere Application Server
Jun 24, 2026
Jun 22, 2026
N/A· v4
9.1 CRITICAL· v3
N/A· v2
IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request...Show more
IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowing the attacker to bypass security controls, spoof identity, escalate privilege, and expose sensitive information.Show less
CVE-2026-10845
1Ibm
1Websphere Application Server
Jun 23, 2026
Jun 22, 2026
N/A· v4
7.3 HIGH· v3
N/A· v2
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications.
CVE-2026-9330
1Ibm
1Websphere Application Server
Jul 22, 2026
Jun 1, 2026
N/A· v4
8.5 HIGH· v3
N/A· v2
IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deserialization using the SAML Web Single Sign-On component. This could result in remote code execution via...Show more
IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deserialization using the SAML Web Single Sign-On component. This could result in remote code execution via a crafted HTTP request when combined with a suitable gadget chain.Show less
CVE-2026-9319
1Ibm
1Websphere Application Server
Jul 22, 2026
Jun 1, 2026
N/A· v4
9.0 CRITICAL· v3
N/A· v2
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security.
CVE-2026-9311
1Ibm
1Websphere Application Server
Jul 22, 2026
Jun 1, 2026
N/A· v4
9.0 CRITICAL· v3
N/A· v2
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to remote code execution caused by the bypass of security controls.
CVE-2026-8644
1Ibm
1Websphere Application Server
Jul 22, 2026
Jun 1, 2026
N/A· v4
9.1 CRITICAL· v3
N/A· v2
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to identity spoofing.
CVE-2026-5516
1Ibm
1Websphere Application Server
Jun 17, 2026
May 27, 2026
N/A· v4
5.9 MEDIUM· v3
N/A· v2
IBM WebSphere Application Server - Liberty 22.0.0.11 through 26.0.0.5 IBM WebSphere Application Server Liberty could allow a remote attacker to bypass security under limited conditions by exploiting a specific timing win...Show more
IBM WebSphere Application Server - Liberty 22.0.0.11 through 26.0.0.5 IBM WebSphere Application Server Liberty could allow a remote attacker to bypass security under limited conditions by exploiting a specific timing window.Show less
CVE-2026-4410
1Ibm
1Websphere Application Server
Jun 17, 2026
May 27, 2026
N/A· v4
7.5 HIGH· v3
N/A· v2
IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a s...Show more
IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.Show less
CVE-2026-8633
1Ibm
1Websphere Application Server
Jul 23, 2026
May 26, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to remote code execution in the Web Server...Show more
IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to remote code execution in the Web Server Plug-ins, through a specially crafted request.Show less