WA
Product
WebSphere Application Server Liberty
On CISA KEVExploited in the wild
533
CVEs
1
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 38High 96Medium 123Low 9
Watch
Add WebSphere Application Server Liberty to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-11806 | 7.5 | Jun 30 | IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability Affected: 17.0.0.3 before 26.0.0.7 |
| CVE-2026-10852 | 7.5 | Jun 22 | Websphere Application Server is Affected By a Denial of Service Affected: 8.5; 9.0 |
| CVE-2026-9320 | 7.5 | Jun 22 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities Affected: 9.0.0 through 7.0.2 Interim Fix 035; 8.5.0 through 7.0.3 Interim Fix 017 |
| CVE-2026-9071 | 7.5 | Jun 22 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by Uncontrolled Resource Consumption Affected: 9.0.0 through 7.0.2 Interim Fix 035; 8.5.0 through 7.0.3 Interim Fix 017 |
| CVE-2026-4410 | 7.5 | May 27 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service Affected: 9.0; 8.5 |
| CVE-2026-8620 | 7.5 | May 26 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities when using when using Web Server Plug-ins Affected: 8.5.0.0 before 8.5.5.30; 8.5.0.0 before 8.5.5.30; 9.0.0.0 before 9.0.5.28; 9.0.0.0 before 9.0.5.28 |
| CVE-2025-36047 | 7.5 | Aug 14 | IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request Affected: 18.0.0.2 before 25.0.0.9 |
| CVE-2025-33142 | 7.5 | Aug 14 | IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for TLS connections Affected: 8.5.0.0 before 8.5.5.29; 9.0.0.0 before 9.0.5.25 |
| CVE-2025-36124 | 7.5 | Aug 12 | IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a failure to honor JMS messaging… Affected: 17.0.0.3 before 25.0.0.9 |
| CVE-2024-56339 | 7.5 | Aug 7 | IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker to bypass security restrictions caused by a… Affected: 17.0.0.3 through 25.0.0.7; 9.0.0.0 |
| CVE-2025-36097 | 7.5 | Jul 16 | IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 are vulnerable to a denial of service, caused by a stack-based overflow Affected: 9.0.0.0 before 9.0.5.24; 17.0.0.3 before 25.0.0.8 |
| CVE-2024-45085 | 7.5 | Oct 15 | IBM WebSphere Application Server 8.5 is vulnerable to a denial of service, under certain configurations, caused by an unexpected specially crafted request Affected: 8.5.0.0 before 8.5.5.27 |
| CVE-2023-50314 | 7.5 | Aug 14 | IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.8 could allow an attacker with access to the network to conduct spoofing attacks Affected: 17.0.0.3 through 24.0.0.8 |
| CVE-2024-25026 | 7.5 | Apr 25 | IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 are vulnerable to a denial of service, caused by sending a… Affected: 8.5.0.0 through 8.5.5.25; 9.0.0.0 through 9.0.5.19; 17.0.0.3 through 24.0.0.4 |
| CVE-2024-27268 | 7.5 | Apr 4 | IBM WebSphere Application Server Liberty 18.0.0.2 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request Affected: 18.0.0.2 before 24.0.0.5 |
| CVE-2024-22353 | 7.5 | Mar 31 | IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request Affected: 17.0.0.3 through 24.0.0.3 |
| CVE-2023-38737 | 7.5 | Aug 16 | IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request Affected: 22.0.0.13 through 23.0.0.7 |
| CVE-2023-30441 | 7.5 | Apr 29 | IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and… Affected: 8.5.0.0 before 8.5.5.23; 9.0.0.0 |
| CVE-2022-43917 | 7.5 | Jan 26 | IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensitive information Affected: 8.5; 9.0 |
| CVE-2021-38951 | 7.5 | Dec 9 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request Affected: 7.0; 8.0; 8.5; 9.0 |
| CVE-2021-20354 | 7.5 | Feb 18 | IBM WebSphere Application Server 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories Affected: 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.19; 9.0.0.0 through 9.0.5.6 |
| CVE-2020-4576 | 7.5 | Oct 1 | IBM WebSphere Application Server 7.5, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a specially-crafted sequence of serialized… Affected: 7.0.0.0 before 7.0.0.45; 8.0.0.0 before 8.0.0.15; 8.5.0.0 before 8.5.5.19; 9.0.0.0 before 9.0.5.6 |
| CVE-2020-4643 | 7.5 | Sep 21 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.17; 9.0.0.0 through 9.0.5.5 |
| CVE-2020-4449 | 7.5 | Jun 5 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive information with a specially-crafted sequence of serialized… Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.17; 9.0.0.0 through 9.0.5.4 |
| CVE-2020-4276 | 7.5 | Mar 26 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-based authentication in an admin request… Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.17; 9.0.0.0 through 9.0.5.3 |
| CVE-2019-4720 | 7.5 | Jan 31 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request Affected: before 20.0.0.2; 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.17; 9.0.0.0 through 9.0.5.2; 9.0.0.0 through 9.0.5.2 |
| CVE-2019-4269 | 7.5 | Jun 28 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console could allow a remote attacker to obtain sensitive information when a specially crafted url causes a stack… Affected: 9.0.0.0 through 9.0.0.11 |
| CVE-2019-4046 | 7.5 | Mar 25 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by improper handling of request headers Affected: before 19.0.0.4; 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.15; 9.0.0.0 through 9.0.0.10 |
| CVE-2018-1683 | 7.5 | Sep 26 | IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by the failure to encrypt ORB communication Affected: before 18.0.0.3 |
| CVE-2018-1553 | 7.5 | Jun 27 | IBM WebSphere Application Server Liberty prior to 18.0.0.2 could allow a remote attacker to obtain sensitive information, caused by mishandling of exceptions by the SAML Web SSO… Affected: before 18.0.0.2 |
| CVE-2018-1614 | 7.5 | Jun 26 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using malformed SAML responses from the SAML identity provider could allow a remote attacker to obtain sensitive… Affected: 7.0; 8.0; 8.5; 9.0 |
| CVE-2016-8919 | 7.5 | Feb 1 | IBM WebSphere Application Server may be vulnerable to a denial of service, caused by allowing serialized objects from untrusted sources to run and cause the consumption of… Affected: 7.0; 8.0; 8.5.5; 9.0 |
| CVE-2016-9879 | 7.5 | Jan 6 | An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1 Affected: 8.5.0.0; 8.5.0.1; 8.5.0.2; 8.5.5.0; 8.5.5.1; 8.5.5.2; +7 more |
| CVE-2016-5983 | 7.5 | Oct 5 | IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2, and Liberty before 16.0.0.4 allows remote authenticated… Affected: 7.0; 7.0.0.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; +34 more |
| CVE-2016-5986 | 7.5 | Oct 1 | IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, 8.5.x before 8.5.5.11, 9.0.x before 9.0.0.2, and Liberty before 16.0.0.3 mishandles responses,… Affected: 7.0; 7.0.0.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; +34 more |
| CVE-2016-2945 | 7.5 | Jul 8 | The API Discovery implementation in IBM WebSphere Application Server (WAS) 8.5.5.8 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote authenticated users to… Affected: 8.5.5.8; 8.5.5.9 |
| CVE-2016-2923 | 7.5 | Jul 7 | IBM WebSphere Application Server (WAS) 8.5 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 does not include the HTTPOnly flag in a Set-Cookie header for an unspecified… Affected: 8.5.5.0; 8.5.5.1; 8.5.5.2; 8.5.5.3; 8.5.5.4; 8.5.5.5; +4 more |
| CVE-2000-0497 | 7.5 | Jun 8 | IBM WebSphere server 3.0.2 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case Affected: 3.0.2 |
| CVE-2026-10845 | 7.3 | Jun 22 | IBM WebSphere Application Server is affected by an authentication bypass vulnerability Affected: 8.5.0 through 7.0.2 Interim Fix 035; 9.0.0 through 7.0.3 Interim Fix 017 |
| CVE-2025-14915 | 7.2 | Mar 25 | IBM WebSphere Application Server Liberty is affected by a privilege escalation vulnerability Affected: 17.0.0.3 before 26.0.0.4 |
| CVE-2024-35154 | 7.2 | Jul 9 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code Affected: 8.5.0.0 through 8.5.5.25; 9.0.0.0 through 9.0.5.20 |
| CVE-2020-4163 | 7.2 | Feb 4 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, under specialized conditions, could allow an authenticated user to create a maliciously crafted file name which would be… Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.16; 9.0.0.0 through 9.0.5.2 |
| CVE-2026-9176 | 7.1 | Sep 10 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2018-1905 | 7.1 | Nov 26 | IBM WebSphere Application Server 9.0.0.0 through 9.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data Affected: 9.0.0.0 through 9.0.0.9 |
| CVE-2017-1382 | 7.1 | Jul 24 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 might create files using the default permissions instead of the customized permissions when custom startup scripts are used Affected: 7.0.0.0 through 7.0.0.43; 8.0.0.0 through 8.0.0.13; 8.5.0.0 through 8.5.5.12; 9.0.0.0 through 9.0.0.4 |
| CVE-2024-22354 | 7.0 | Apr 17 | IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity Injection (XXE) attack… Affected: 8.5.0.0 before 8.5.5.26; 9.0.0.0 before 9.0.5.20; 17.0.0.3 before 24.0.0.6 |
The 500 most important CVEs for this product (exploited first, then by severity)