← Back

Websphere Application Server

websphere_application_server

Vendor: Ibm • 503 CVEs

CVEs (503)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2026-95696
1Ibm
1Websphere Application Server
Oct 22, 2026
Oct 13, 2026
N/A· v4
7.5 HIGH· v3
N/A· v2
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
CVE-2026-95695
1Ibm
1Websphere Application Server
Oct 22, 2026
Oct 13, 2026
N/A· v4
9.1 CRITICAL· v3
N/A· v2
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
CVE-2026-93909
1Ibm
1Websphere Application Server
Oct 22, 2026
Oct 13, 2026
N/A· v4
9.1 CRITICAL· v3
N/A· v2
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
CVE-2026-93905
1Ibm
1Websphere Application Server
Oct 22, 2026
Oct 13, 2026
N/A· v4
8.2 HIGH· v3
N/A· v2
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
CVE-2026-93895
1Ibm
1Websphere Application Server
Oct 22, 2026
Oct 13, 2026
N/A· v4
9.1 CRITICAL· v3
N/A· v2
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
CVE-2026-11538
1Ibm
1Websphere Application Server
Sep 24, 2026
Sep 18, 2026
N/A· v4
5.3 MEDIUM· v3
N/A· v2
IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies.
CVE-2026-9667
1Ibm
1Websphere Application Server
Sep 15, 2026
Sep 10, 2026
N/A· v4
5.3 MEDIUM· v3
N/A· v2
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints.
CVE-2026-9327
1Ibm
1Websphere Application Server
Sep 15, 2026
Sep 10, 2026
N/A· v4
8.1 HIGH· v3
N/A· v2
IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service.
CVE-2026-9176
1Ibm
1Websphere Application Server
Sep 15, 2026
Sep 10, 2026
N/A· v4
7.1 HIGH· v3
N/A· v2
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized acc...Show more
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources.Show less
CVE-2026-9338
1Ibm
1Websphere Application Server
Sep 16, 2026
Sep 10, 2026
N/A· v4
5.3 MEDIUM· v3
N/A· v2
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to trigger excessive resource consumpt...Show more
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to trigger excessive resource consumption, potentially leading to reduced availability of the affected service.Show less
CVE-2026-9336
1Ibm
1Websphere Application Server
Sep 16, 2026
Sep 10, 2026
N/A· v4
7.5 HIGH· v3
N/A· v2
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted HTTP request to an administrative endpoint. A remote attacker could exploit this vulnerability to...Show more
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted HTTP request to an administrative endpoint. A remote attacker could exploit this vulnerability to cause the server to exhaust filesystem space.Show less
CVE-2026-14525
1Ibm
1Websphere Application Server
Aug 17, 2026
Aug 13, 2026
N/A· v4
9.4 CRITICAL· v3
N/A· v2
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.
CVE-2026-10571
1Ibm
1Websphere Application Server
Aug 17, 2026
Aug 13, 2026
N/A· v4
5.3 MEDIUM· v3
N/A· v2
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consum...Show more
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.Show less
CVE-2026-18499
1Ibm
1Websphere Application Server
Aug 17, 2026
Aug 12, 2026
N/A· v4
8.1 HIGH· v3
N/A· v2
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.
CVE-2026-8400
1Ibm
1Websphere Application Server
Aug 10, 2026
Aug 5, 2026
N/A· v4
9.8 CRITICAL· v3
N/A· v2
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to i...Show more
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes.Show less
CVE-2026-11536
1Ibm
1Websphere Application Server
Aug 5, 2026
Jul 30, 2026
N/A· v4
8.5 HIGH· v3
N/A· v2
IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.
CVE-2026-9322
1Ibm
1Websphere Application Server
Aug 12, 2026
Jul 30, 2026
N/A· v4
7.5 HIGH· v3
N/A· v2
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request.
CVE-2026-10842
1Ibm
1Websphere Application Server
Aug 5, 2026
Jul 30, 2026
N/A· v4
7.5 HIGH· v3
N/A· v2
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints.
CVE-2026-14980
1Ibm
1Websphere Application Server
Aug 4, 2026
Jul 30, 2026
N/A· v4
8.8 HIGH· v3
N/A· v2
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveControlle...Show more
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.Show less
CVE-2026-11897
1Ibm
1Websphere Application Server
Aug 4, 2026
Jul 30, 2026
N/A· v4
7.5 HIGH· v3
N/A· v2
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the se...Show more
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.Show less