Ibm WebSphere Application Server - Liberty vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Ibm WebSphere Application Server - Liberty: 47 record(s), with affected versions and fixes.
CVE-2026-15325
High · 8.7
CWE-444 Jul 28, 2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE requests.
CVE-2026-15280
High · 7.5
CWE-22 Jul 28, 2026
IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism.
CVE-2026-15064
High · 8.7
CWE-444 Jul 28, 2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.
CVE-2026-15057
High · 7.5
CWE-787 Jul 28, 2026
IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation.
CVE-2026-14981
High · 7.5
CWE-400 Jul 28, 2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits.
CVE-2026-14976
Critical · 9.8
CWE-306 Jul 28, 2026
IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.
CVE-2026-16192
Medium · 6.5
CWE-674 Jul 28, 2026
IBM WebSphere Application Server Liberty is affected by a denial of service
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled.
CVE-2026-11806
High · 7.5
CWE-444 Jun 30, 2026
IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.
CVE-2026-11714
Critical · 9.8
CWE-918 Jun 30, 2026
IBM WebSphere Application Server Liberty: SSRF in apiDiscovery-1.0
IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled.
CVE-2026-11546
Critical · 9.8
CWE-918 Jun 30, 2026
IBM WebSphere Application Server Liberty SSRF (CVE-2026-11546)
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.
CVE-2026-9320
High · 7.5
CWE-400 Jun 22, 2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
CVE-2026-9071
High · 7.5
CWE-400 Jun 22, 2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by Uncontrolled Resource Consumption
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
CVE-2026-8646
Critical · 9.1
CWE-444 Jun 22, 2026
IBM WebSphere Application Server and Liberty HTTP Request Smuggling Vulnerability
IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowing the attacker to bypass security controls, spoof identity, escalate privilege, and expose sensitive information.
CVE-2026-5516
Medium · 5.9
CWE-362 May 27, 2026
IBM WebSphere Application Server Liberty is affected by a security bypass vulnerability
IBM WebSphere Application Server - Liberty 22.0.0.11 through 26.0.0.5 IBM WebSphere Application Server Liberty could allow a remote attacker to bypass security under limited conditions by exploiting a specific timing window.
CVE-2026-4410
High · 7.5
CWE-400 May 27, 2026
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service
IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
CVE-2026-3621
Medium · 5.9
CWE-269 Apr 22, 2026
IBM WebSphere Application Server Liberty is affected by identity spoofing
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.4 IBM WebSphere Application Server Liberty is vulnerable to identity spoofing under limited conditions when an application is deployed without authentication and authorization configured.
CVE-2026-1561
Medium · 5.4
CWE-918 Mar 25, 2026
IBM WebSphere Application Server Liberty Server-Side Request Forgery
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is vulnerable to server-side request forgery (SSRF). This may allow remote attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
CVE-2025-14917
Critical · 9.8
CWE-1393 Mar 25, 2026
IBM WebSphere Application Server Liberty could provide weaker than expected security
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings.
CVE-2025-14915
High · 7.2
CWE-200 Mar 25, 2026
IBM WebSphere Application Server Liberty is affected by a privilege escalation vulnerability
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is affected by privilege escalation. A privileged user could gain additional access to the application server.
CVE-2025-14923
Critical · 9.8
CWE-798 Mar 3, 2026
IBM WebSphere Application Server Liberty could provide weaker than expected security
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.2 IBM WebSphere Application Server Liberty could provide weaker than expected security when using the Security Utility when administering security settings.
CVE-2025-14914
High · 7.6
CWE-22 Feb 2, 2026
IBM WebSphere Application Server Liberty Path Traversal
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive containing path traversal sequences resulting in an overwrite of files leading to arbitrary code execution.
CVE-2025-12635
Medium · 5.4
CWE-79 Dec 8, 2025
IBM WebSphere Application Server and WebSphere Application Server Liberty Cross-Site Scripting
IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to improper validation of user-supplied input. An attacker could exploit this vulnerability by using a specially crafted URL to redirect the user to a malicious site.