Websphere Application Server Liberty (Ibm) - vulnerabilities (CVEs)

32 CVEs, 14 in the last 30 days, 25 known versions, newest CVE from 2026-10-13. Vendor: Ibm.

CVEs of Websphere Application Server Liberty

CVE-2026-93905 - CVSS 8.2 (high), 2026-10-13: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch…
CVE-2026-93909 - CVSS 9.1 (critical), 2026-10-13: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is…
CVE-2026-93895 - CVSS 9.1 (critical), 2026-10-13: IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on…
CVE-2026-95695 - CVSS 9.1 (critical), 2026-10-13: IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect…
CVE-2026-95696 - CVSS 7.5 (high), 2026-10-13: IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
CVE-2026-101294 - CVSS 8.7 (high), 2026-10-13: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to…
CVE-2026-105442 - CVSS 7.5 (high), 2026-10-13: IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker…
CVE-2026-105443 - CVSS 8.2 (high), 2026-10-13: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.
CVE-2026-11713 - CVSS 5.4 (medium), 2026-10-13: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature…
CVE-2026-14532 - CVSS 4.3 (medium), 2026-10-13: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught…
CVE-2026-14909 - CVSS 6.5 (medium), 2026-10-13: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated…
CVE-2026-77816 - CVSS 6.5 (medium), 2026-10-13: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit…
CVE-2026-79715 - CVSS 5.5 (medium), 2026-10-13: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use…
CVE-2026-103499 - CVSS 7.5 (high), 2026-10-13: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote…
CVE-2026-11722 - CVSS 4.8 (medium), 2026-09-18: IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request…
CVE-2026-11549 - CVSS 6.5 (medium), 2026-09-18: IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by a virtual host bypass…
CVE-2026-11548 - CVSS 4.8 (medium), 2026-09-18: IBM WebSphere Application Server 8.5 and 9.0, and and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request…
CVE-2026-10841 - CVSS 4.8 (medium), 2026-09-18: IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling.
CVE-2026-15396 - CVSS 6.5 (medium), 2026-09-14: IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request…
CVE-2026-15412 - CVSS 6.5 (medium), 2026-09-14: IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 could allow a remote attacker to…
CVE-2026-15634 - CVSS 6.5 (medium), 2026-09-14: IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request…
CVE-2026-14525 - CVSS 9.4 (critical), 2026-08-13: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when…
CVE-2026-10571 - CVSS 5.7 (medium), 2026-08-13: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged,…
CVE-2026-18499 - CVSS 8.1 (high), 2026-08-12: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.
CVE-2026-8400 - CVSS 9.8 (critical), 2026-08-05: IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK,…
CVE-2026-10842 - CVSS 7.5 (high), 2026-07-30: IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a…
CVE-2026-11897 - CVSS 7.5 (high), 2026-07-30: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A…
CVE-2026-14980 - CVSS 8.8 (high), 2026-07-30: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF…
CVE-2026-14976 - CVSS 9.8 (critical), 2026-07-28: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.
CVE-2024-25026 - CVSS 7.5 (high), 2024-04-25: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 are vulnerable to a denial of service, caused…
CVE-2024-22329 - CVSS 4.3 (medium), 2024-04-17: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3 are vulnerable to server-side request forgery…
CVE-2024-22354 - CVSS 7 (high), 2024-04-17: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity…
CVE-2024-27268 - CVSS 7.5 (high), 2024-04-04: IBM WebSphere Application Server Liberty 18.0.0.2 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A…
CVE-2024-22353 - CVSS 7.5 (high), 2024-03-31: IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A…
CVE-2024-27270 - CVSS 6.1 (medium), 2024-03-27: IBM WebSphere Application Server Liberty 23.0.0.3 through 24.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
CVE-2023-50312 - CVSS 6.5 (medium), 2024-03-01: IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.2 could provide weaker than expected security for outbound TLS connections caused by a…
CVE-2023-46158 - CVSS 9.8 (critical), 2023-10-25: IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security due to improper resource expiration handling.…
CVE-2023-38737 - CVSS 7.5 (high), 2023-08-16: IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A…
CVE-2022-34165 - CVSS 5.4 (medium), 2022-09-09: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.9 are vulnerable to HTTP header…
CVE-2022-22476 - CVSS 8.8 (high), 2022-07-08: IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty are vulnerable to identity spoofing by an authenticated user using a…
CVE-2022-22475 - CVSS 6.5 (medium), 2022-05-17: IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are vulnerable to identity spoofing by an authenticated user. IBM X-Force…
CVE-2022-22393 - CVSS 6.5 (medium), 2022-05-13: IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.5 , with the adminCenter-1.0 feature configured, could allow an authenticated user to issue a…
CVE-2021-39038 - CVSS 5.4 (medium), 2022-02-24: IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow a remote attacker to hijack the…
CVE-2021-39031 - CVSS 8.8 (high), 2022-01-25: IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to conduct an LDAP injection. By using a…
CVE-2022-22310 - CVSS 6.5 (medium), 2022-01-19: IBM WebSphere Application Server Liberty 21.0.0.10 through 21.0.0.12 could provide weaker than expected security. A remote attacker could exploit this…
CVE-2021-29842 - CVSS 5.3 (medium), 2021-09-16: IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference…
CVE-2020-4590 - CVSS 6.5 (medium), 2020-09-21: IBM WebSphere Application Server Liberty 17.0.0.3 through 20.0.0.9 running oauth-2.0 or openidConnectServer-1.0 server features is vulnerable to a denial of…
CVE-2020-4421 - CVSS 5.4 (medium), 2020-05-06: IBM WebSphere Application Liberty 19.0.0.5 through 20.0.0.4 could allow an authenticated user using openidconnect to spoof another users identify. IBM X-Force…
CVE-2020-4329 - CVSS 4.3 (medium), 2020-04-28: IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 20.0.0.4 could allow a remote, authenticated attacker to obtain sensitive…
CVE-2020-4304 - CVSS 6.1 (medium), 2020-04-02: IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
CVE-2020-4303 - CVSS 6.1 (medium), 2020-04-02: IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…