Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 958

Export CSV
CVE-2026-8400

Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server Websphere Application Server Liberty
CVE-2026-11536

IBM WebSphere Application Server is affected by a remote code execution vulnerability

IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server
CVE-2026-10842

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server Websphere Application Server Liberty Websphere Application Server Liberty
CVE-2026-14980

IBM WebSphere Application Server Liberty is affected by a cross-site request forgery

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server Websphere Application Server Liberty
CVE-2026-11897

IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server Websphere Application Server Liberty
CVE-2026-2482

IBM WebSphere Application Server Liberty is affected by a cross-site request forgery

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server Websphere Application Server Liberty
CVE-2026-14529

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server Websphere Application Server Liberty
CVE-2026-14528

IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information

IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server
CVE-2026-11541

Inconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms.

IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server Websphere Application Server Liberty
CVE-2026-14446

IBM WebSphere Application Server is affected by a privilege escalation

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server
CVE-2026-14515

IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities

IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server
CVE-2026-16184

IBM WebSphere Application Server is affected by an authentication bypass

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server
CVE-2026-15280

IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server Websphere Application Server Liberty
CVE-2026-14974

IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities

IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server
CVE-2026-14512

IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information

IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Websphere Application Server
CVE-2026-9072

WebSphere Application Server Remote Code Execution

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intelligent Management with the WebSphere WebServer Plug-in component - are vulnerable to remote code execution and denial of service. This vulnerability can be exploited when an attacker impersonates backend servers and sends crafted responses to the plug-in.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I Websphere Application Server
CVE-2026-8858

WebSphere Application Server Remote Code Execution

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote code execution and denial of service in the WebSphere Web Server Plug-in component. This vulnerability can be exploited when an attacker impersonates the application server and sends crafted responses to the plug-in.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
I Websphere Application Server