IBM Websphere Application Server - Liberty
45 CVEs affecting IBM Websphere Application Server - Liberty. Latest disclosed: 2026-10-13. Critical: 4, High: 27.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14525 | Critical | 9.4 | 2026-08-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when th… |
CVE-2026-14529 | Critical | 9.4 | 2026-07-29 | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side… |
CVE-2026-93909 | Critical | 9.1 | 2026-10-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabl… |
CVE-2026-93895 | Critical | 9.1 | 2026-10-13 | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on g… |
CVE-2026-101294 | High | 8.7 | 2026-10-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass… |
CVE-2026-15325 | High | 8.7 | 2026-07-28 | IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE reque… |
CVE-2026-15064 | High | 8.7 | 2026-07-28 | IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper handling of non-standa… |
CVE-2026-11714 | High | 8.5 | 2026-06-30 | IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled. |
CVE-2026-14980 | High | 8.3 | 2026-07-30 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF… |
CVE-2026-93905 | High | 8.2 | 2026-10-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch j… |
CVE-2026-105443 | High | 8.2 | 2026-10-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install. |
CVE-2026-18499 | High | 8.1 | 2026-08-12 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives. |
CVE-2026-8400 | High | 8.1 | 2026-08-05 | IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Ja… |
CVE-2026-105442 | High | 7.5 | 2026-10-13 | IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker t… |
CVE-2026-103499 | High | 7.5 | 2026-10-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenti… |
CVE-2026-9322 | High | 7.5 | 2026-07-30 | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service vi… |
CVE-2026-10842 | High | 7.5 | 2026-07-30 | IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a re… |
CVE-2026-11897 | High | 7.5 | 2026-07-30 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A rem… |
CVE-2026-15280 | High | 7.5 | 2026-07-28 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the coll… |
CVE-2026-15057 | High | 7.5 | 2026-07-28 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation. |