WA
Product
WebSphere Application Server Liberty
On CISA KEVExploited in the wild
533
CVEs
1
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 38High 96Medium 123Low 9
Watch
Add WebSphere Application Server Liberty to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-1901 | 8.8 | Dec 12 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to temporarily gain elevated privileges on the system, caused by incorrect cached value being used Affected: 8.5.0.0 through 8.5.5.14; 9.0.0.0 through 9.0.0.9 |
| CVE-2017-1731 | 8.8 | Jan 30 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security when using the Administrative Console Affected: 7.0.0.0 through 7.0.0.43; 8.0.0.0 through 8.0.0.14; 8.5.0.0 through 8.5.5.13; 9.0.0.0 through 9.0.0.6 |
| CVE-2017-1194 | 8.8 | Apr 28 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… Affected: 7.0; 8.0; 8.5; 9.0 |
| CVE-2026-101294 | 8.7 | Oct 13 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step Affected: 8.5; 9.0 |
| CVE-2026-15064 | 8.7 | Jul 28 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-15325 | 8.7 | Jul 28 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-11536 | 8.5 | Jul 30 | IBM WebSphere Application Server is affected by a remote code execution vulnerability Affected: 9.0; 8.5 |
| CVE-2026-9330 | 8.5 | Jun 1 | IBM WebSphere Application Server is affected by remote code execution Affected: 9.0 through 1.1.9.12; 8.5 |
| CVE-2026-93905 | 8.2 | Oct 13 | IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data Affected: 17.0.0.3 before 26.0.0.11 |
| CVE-2021-20492 | 8.2 | May 26 | IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.19; 9.0.0.0 through 9.0.5.7; 17.0.0.3 through 21.0.0.5 |
| CVE-2021-20454 | 8.2 | Apr 21 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.19; 9.0.0.0 through 9.0.5.7 |
| CVE-2021-20453 | 8.2 | Apr 20 | IBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data Affected: 8.0.0.0 before 8.0.0.15; 8.5.0.0 before 8.5.5.20; 9.0.0.0 before 9.0.5.8 |
| CVE-2021-20353 | 8.2 | Feb 10 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 7.0.0.0 before 7.0.0.45; 8.0.0.0 before 8.0.0.15; 8.5.0.0 before 8.5.5.20; 9.0.0.0 before 9.0.5.7 |
| CVE-2020-4949 | 8.2 | Jan 26 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.18; 9.0.0.0 through 9.0.5.6 |
| CVE-2026-93907 | 8.1 | Oct 13 | IBM WebSphere Application Server is affected by a bypass authentication vulnerability Affected: 8.5; 9.0 |
| CVE-2026-9327 | 8.1 | Sep 10 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-18499 | 8.1 | Aug 12 | IBM WebSphere Application Server Liberty is affected by a privilege escalation Affected: 17.0.0.3 before 26.0.0.9 |
| CVE-2026-15328 | 8.1 | Jul 28 | IBM WebSphere Application Server and WebSphere Application Server Liberty is inconsistent Interpretation of HTTP Requests Affected: 9.0; 8.5 |
| CVE-2018-1840 | 8.1 | Dec 3 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to gain elevated privileges on the system, caused when a security domain is configured to use a… Affected: 8.5.0.0 through 8.5.5.14; 9.0.0.0 through 9.0.0.9 |
| CVE-2017-1137 | 8.1 | May 10 | IBM WebSphere Application Server 8.0 and 8.5.5 could provide weaker than expected security Affected: 8.0; 8.5; 8.5.5 |
| CVE-2017-1151 | 8.1 | Mar 20 | IBM WebSphere Application Server 8.0, 8.5, 8.5.5, and 9.0 using OpenID Connect (OIDC) configured with a Trust Association Interceptor (TAI) could allow a user to gain elevated… Affected: 8.0; 8.5; 8.5.5; 9.0 |
| CVE-2026-95680 | 8.0 | Oct 13 | IBM WebSphere Application Server is affected by an authorization bypass Affected: 8.5; 9.0 |
| CVE-2018-1890 | 7.8 | Mar 11 | IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users Affected: 7.0; 8.0; 8.5; 9.0; Liberty |
| CVE-2013-3024 | 7.8 | May 24 | IBM WebSphere Application Server (WAS) 8.5 through 8.5.0.2 on UNIX allows local users to gain privileges by leveraging improper process initialization Affected: 8.5.0.0 through 8.5.0.2 |
| CVE-2025-14914 | 7.6 | Feb 2 | IBM WebSphere Application Server Liberty Path Traversal Affected: 17.0.0.3 through 26.0.0.1 |
| CVE-2025-33104 | 7.6 | May 14 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting Affected: 8.5 before 8.5.5.28; 9.0 before 9.0.5.24 |
| CVE-2026-95696 | 7.5 | Oct 13 | IBM WebSphere Application Server Liberty Denial of Service Affected: 20.0.0.12 before 26.0.0.11 |
| CVE-2026-105442 | 7.5 | Oct 13 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted data Affected: 8.5; 9.0 |
| CVE-2026-103499 | 7.5 | Oct 13 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service Affected: 8.5; 9.0 |
| CVE-2026-9336 | 7.5 | Sep 10 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-9322 | 7.5 | Jul 30 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-10842 | 7.5 | Jul 30 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability Affected: 8.5; 9.0 |
| CVE-2026-11897 | 7.5 | Jul 30 | IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2 Affected: 17.0.0.3 before 26.0.0.8 |
| CVE-2026-14528 | 7.5 | Jul 28 | IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information Affected: 9.0; 8.5 |
| CVE-2026-14981 | 7.5 | Jul 28 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-15057 | 7.5 | Jul 28 | IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability Affected: 17.0.0.3 before 26.0.0.8 |
| CVE-2026-15280 | 7.5 | Jul 28 | IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability Affected: 17.0.0.3 before 26.0.0.9 |
| CVE-2026-11595 | 7.5 | Jun 30 | IBM WebSphere Application Server is affected by a Path Traversal vulnerability Affected: 9.0; 8.5 |
| CVE-2026-11806 | 7.5 | Jun 30 | IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability Affected: 17.0.0.3 before 26.0.0.7 |
| CVE-2026-10852 | 7.5 | Jun 22 | Websphere Application Server is Affected By a Denial of Service Affected: 8.5; 9.0 |
| CVE-2026-9320 | 7.5 | Jun 22 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities Affected: 9.0.0 through 7.0.2 Interim Fix 035; 8.5.0 through 7.0.3 Interim Fix 017 |
| CVE-2026-9071 | 7.5 | Jun 22 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by Uncontrolled Resource Consumption Affected: 9.0.0 through 7.0.2 Interim Fix 035; 8.5.0 through 7.0.3 Interim Fix 017 |
| CVE-2026-4410 | 7.5 | May 27 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service Affected: 9.0; 8.5 |
| CVE-2026-8620 | 7.5 | May 26 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities when using when using Web Server Plug-ins Affected: 8.5.0.0 before 8.5.5.30; 8.5.0.0 before 8.5.5.30; 9.0.0.0 before 9.0.5.28; 9.0.0.0 before 9.0.5.28 |
| CVE-2025-36047 | 7.5 | Aug 14 | IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request Affected: 18.0.0.2 before 25.0.0.9 |
| CVE-2025-33142 | 7.5 | Aug 14 | IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for TLS connections Affected: 8.5.0.0 before 8.5.5.29; 9.0.0.0 before 9.0.5.25 |
| CVE-2025-36124 | 7.5 | Aug 12 | IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a failure to honor JMS messaging… Affected: 17.0.0.3 before 25.0.0.9 |
| CVE-2024-56339 | 7.5 | Aug 7 | IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker to bypass security restrictions caused by a… Affected: 17.0.0.3 through 25.0.0.7; 9.0.0.0 |
| CVE-2025-36097 | 7.5 | Jul 16 | IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 are vulnerable to a denial of service, caused by a stack-based overflow Affected: 9.0.0.0 before 9.0.5.24; 17.0.0.3 before 25.0.0.8 |
| CVE-2024-45085 | 7.5 | Oct 15 | IBM WebSphere Application Server 8.5 is vulnerable to a denial of service, under certain configurations, caused by an unexpected specially crafted request Affected: 8.5.0.0 before 8.5.5.27 |
The 500 most important CVEs for this product (exploited first, then by severity)