WA
Product
WebSphere Application Server Liberty
On CISA KEVExploited in the wild
533
CVEs
1
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 38High 96Medium 123Low 9
Watch
Add WebSphere Application Server Liberty to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-1788 | 5.3 | Mar 22 | IBM WebSphere Application Server 9 installations using Form Login could allow a remote attacker to conduct spoofing attacks Affected: 9.0.0.0 through 9.0.0.7 |
| CVE-2016-9736 | 5.3 | Jun 8 | IBM WebSphere Application Server using malformed SOAP requests could allow a remote attacker to obtain sensitive information Affected: 8.0; 8.5; 9.0 |
| CVE-2016-0389 | 5.3 | Jul 7 | Admin Center in IBM WebSphere Application Server (WAS) 8.5.5.2 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote attackers to obtain sensitive information via… Affected: 8.5.5.2; 8.5.5.3; 8.5.5.4; 8.5.5.5; 8.5.5.6; 8.5.5.7; +2 more |
| CVE-2025-13333 | 4.9 | Feb 17 | IBM WebSphere Application Server could provide weaker than expected security Affected: 9.0 through 9.0.5.27; 8.5 through 8.5.5.29 |
| CVE-2025-36099 | 4.9 | Sep 29 | IBM WebSphere Application Server denial of service Affected: 8.5; 9.0 |
| CVE-2026-11722 | 4.8 | Sep 18 | IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling Affected: 9.0; 8.5 |
| CVE-2026-11548 | 4.8 | Sep 18 | IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling Affected: 9.0; 8.5 |
| CVE-2026-10841 | 4.8 | Sep 18 | IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling Affected: 9.0; 8.5 |
| CVE-2026-16189 | 4.8 | Sep 14 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2025-36000 | 4.8 | Aug 12 | IBM WebSphere Application Server Liberty cross-site scripting Affected: 17.0.0.3 through 25.0.0.8 |
| CVE-2024-45087 | 4.8 | Nov 11 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting Affected: 8.5; 9.0 |
| CVE-2024-45071 | 4.8 | Oct 16 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting Affected: 8.5.0.0 through 8.5.5.26; 9.0.0.0 through 9.0.5.21 |
| CVE-2024-45073 | 4.8 | Sep 30 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting Affected: 8.5; 9.0 |
| CVE-2024-35153 | 4.8 | Jun 27 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting Affected: 8.5.0.0 before 8.5.5.26; 9.0.0.0 before 9.0.5.21 |
| CVE-2026-11537 | 4.3 | Sep 18 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2024-22329 | 4.3 | Apr 17 | IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3 are vulnerable to server-side request forgery (SSRF) Affected: 8.5.0.0 before 8.5.5.26; 9.0.0.0 before 9.0.5.20; 17.0.0.3 before 24.0.0.4 |
| CVE-2020-4365 | 4.3 | May 14 | IBM WebSphere Application Server 8.5 is vulnerable to server-side request forgery Affected: 8.5.0.0 through 8.5.5.17 |
| CVE-2020-4329 | 4.3 | Apr 28 | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 20.0.0.4 could allow a remote, authenticated attacker to obtain sensitive information, caused by… Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.17; 9.0.0.0 through 9.0.5.3; 17.0.0.3 through 20.0.0.4 |
| CVE-2019-4442 | 4.3 | Sep 17 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9,0 could allow a remote attacker to traverse directories on the file system Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.16; 9.0.0.0 through 9.0.5.1 |
| CVE-2018-1902 | 4.3 | Mar 11 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to spoof connection information which could be used to launch further attacks against the… Affected: 7.0; 8.0; 8.5; 9.0 |
| CVE-2017-1743 | 4.3 | May 4 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of Administrative Console panel… Affected: 7.0; 8.0; 8.5; 9.0 |
| CVE-2017-1741 | 4.3 | Mar 14 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of Administrative Console panel… Affected: 7.0; 8.0; 8.5; 9.0 |
| CVE-2016-0377 | 4.3 | Oct 22 | The Administrative Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, and 8.5.x before 8.5.5.10 mishandles CSRFtoken cookies, which… Affected: 7.0.0.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +34 more |
The 500 most important CVEs for this product (exploited first, then by severity)