Vulnerabilities

Filters

Reset all

2 selected

503 records

Sort

Vendor: IBM Component: Websphere Application Server Clear all filters

TI-2026-73526 CVE-2026-93905 · GHSA-8wqc-ccmq-2r2f

Deserialization flaw in IBM WebSphere Liberty corrupts batch job state

MEDIUM 42

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00331 Published 2026-10-13 No fix listed CWE-502

TI-2026-73527 CVE-2026-93909 · GHSA-vcr6-887c-vp66

Authentication bypass in IBM WebSphere Application Server Liberty

MEDIUM 47

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00337 Published 2026-10-13 No fix listed CWE-384

TI-2026-73525 CVE-2026-93895 · GHSA-3r8m-rjq2-w53r

Access control bypass in IBM WebSphere Application Server Liberty

MEDIUM 41

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00394 Published 2026-10-13 No fix listed CWE-284

TI-2026-73535 CVE-2026-95695 · GHSA-pxc5-x8x9-34qq

Incorrect authorization in IBM WebSphere Application Server Liberty

MEDIUM 41

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00323 Published 2026-10-13 No fix listed CWE-863

TI-2026-73536 CVE-2026-95696 · GHSA-5fmc-fgcm-wfm8

IBM WebSphere Application Server Liberty denial of service

LOW 39

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00331 Published 2026-10-13 No fix listed CWE-400

TI-2026-09967 CVE-2026-11538 · GHSA-wgpc-w629-m235

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

LOW 23

IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00163 Published 2026-09-18 No fix listed CWE-117

TI-2026-08481 CVE-2026-9667 · GHSA-83q6-79hr-m7rr

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

LOW 30

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00428 Published 2026-09-10 No fix listed CWE-918

TI-2026-08065 CVE-2026-9176 · GHSA-cmhg-73x2-j8g7

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

LOW 32

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00164 Published 2026-09-10 No fix listed CWE-94

TI-2026-08184 CVE-2026-9327 · GHSA-9vhj-xhjf-hgp8

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

LOW 35

IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00372 Published 2026-09-10 No fix listed CWE-269

TI-2026-08189 CVE-2026-9336 · GHSA-fw6w-g4f4-936x

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

LOW 34

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted HTTP request to an administrative endpoint.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00772 Published 2026-09-10 No fix listed CWE-306

TI-2026-08190 CVE-2026-9338 · GHSA-p349-w9qj-fpxx

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

LOW 31

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted request.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0049 Published 2026-09-10 No fix listed CWE-400

TI-2026-12260 CVE-2026-14525 · GHSA-fpr6-jmjm-9r5g

IBM WebSphere Application Server Liberty is affected by an authenication bypass

MEDIUM 49

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.0055 Published 2026-08-13 No fix listed CWE-306

TI-2026-09093 CVE-2026-10571 · GHSA-fcg5-434v-xp4q

IBM WebSphere Application Server Liberty is affected by a denial of service

LOW 26

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization.

CVSS 3.1MEDIUM 5.7 Adjacent network Low privileges No interaction EPSS 0.00593 Published 2026-08-13 No fix listed CWE-502

TI-2026-15189 CVE-2026-18499 · GHSA-fg2c-rf98-x93f

IBM WebSphere Application Server Liberty is affected by a privilege escalation

LOW 38

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00419 Published 2026-08-12 No fix listed CWE-285

TI-2026-07382 CVE-2026-8400 · GHSA-m4rx-9mrh-59g9

Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and…

MEDIUM 43

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to i…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00481 Published 2026-08-05 Fixed CWE-470

TI-2026-09965 CVE-2026-11536 · GHSA-6qjg-94q2-5wvp

IBM WebSphere Application Server is affected by a remote code execution vulnerability

MEDIUM 40

IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00583 Published 2026-07-30 No fix listed CWE-502

TI-2026-08182 CVE-2026-9322 · GHSA-3h25-mhp4-65pq

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

MEDIUM 40

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00556 Published 2026-07-30 No fix listed CWE-400

TI-2026-09308 CVE-2026-10842 · GHSA-xhv7-44rm-j43c

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by…

LOW 39

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00526 Published 2026-07-30 No fix listed CWE-289

TI-2026-10265 CVE-2026-11897 · GHSA-89rj-ccwc-wmpm

IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2

MEDIUM 40

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00533 Published 2026-07-30 No fix listed CWE-770

TI-2026-10114 CVE-2026-11707 · GHSA-wqwm-6mc2-j593

Cross-site scripting in IBM Tivoli System Automation Application Manager

MEDIUM 42

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00384 Published 2026-07-30 No fix listed CWE-79

TI-2026-09825 CVE-2026-11383 · GHSA-72hc-pg85-56c6

Cross-site Scripting in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager

LOW 24

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00231 Published 2026-07-30 No fix listed CWE-79

TI-2026-12612 CVE-2026-14980 · GHSA-78m2-w26r-hcp9

IBM WebSphere Application Server Liberty is affected by a cross-site request forgery

MEDIUM 40

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveControlle…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0043 Published 2026-07-30 No fix listed CWE-269

TI-2026-02109 CVE-2026-2482 · GHSA-rxf7-xjqf-rhqf

IBM WebSphere Application Server Liberty is affected by a cross-site request forgery

LOW 37

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that th…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00151 Published 2026-07-29 No fix listed CWE-352

TI-2026-12263 CVE-2026-14529 · GHSA-545h-jr28-6wfq

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery

MEDIUM 49

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipSe…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00525 Published 2026-07-29 No fix listed CWE-306

TI-2026-12213 CVE-2026-14446 · GHSA-5gj2-qr7h-mvwp

IBM WebSphere Application Server is affected by a privilege escalation

MEDIUM 49

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00525 Published 2026-07-28 No fix listed CWE-306