WA
Product
WebSphere Application Server Liberty
On CISA KEVExploited in the wild
533
CVEs
1
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 38High 96Medium 123Low 9
Watch
Add WebSphere Application Server Liberty to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-12635 | 5.4 | Dec 8 | IBM WebSphere Application Server and WebSphere Application Server Liberty Cross-Site Scripting Affected: 9.0 through 2.0.18; 8.5 |
| CVE-2023-26283 | 5.4 | Apr 2 | IBM WebSphere Application Server 9.0 is vulnerable to cross-site scripting Affected: 9.0 |
| CVE-2022-40750 | 5.4 | Nov 11 | IBM WebSphere Application Server 8.5, and 9.0 is vulnerable to cross-site scripting Affected: 8.5; 9.0 |
| CVE-2022-34336 | 5.4 | Sep 13 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting Affected: 7.0; 8.0; 8.5; 9.0 |
| CVE-2022-34165 | 5.4 | Sep 9 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.9 are vulnerable to HTTP header injection, caused by… Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.22; 9.0.0.0 through 9.0.5.13; 17.0.0.3 before 22.0.0.9 |
| CVE-2021-39038 | 5.4 | Feb 24 | IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow a remote attacker to hijack the clicking action of the… Affected: 9.0.0.0 before 9.0.5.12; 17.0.0.3 through 22.0.0.2 |
| CVE-2020-4578 | 5.4 | Sep 10 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.17; 9.0.0.0 through 9.0.5.5 |
| CVE-2020-4421 | 5.4 | May 6 | IBM WebSphere Application Liberty 19.0.0.5 through 20.0.0.4 could allow an authenticated user using openidconnect to spoof another users identify Affected: 19.0.0.5 before 20.0.0.5 |
| CVE-2019-4663 | 5.4 | Dec 10 | IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting Affected: 17.0.0.3 before 19.0.0.11 |
| CVE-2019-4270 | 5.4 | Sep 17 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site scripting Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.16; 9.0.0.0 through 9.0.5.0 |
| CVE-2019-4285 | 5.4 | Jul 30 | IBM WebSphere Application Server - Liberty Admin Center could allow a remote attacker to hijack the clicking action of the victim Affected: All versions, or not specified |
| CVE-2019-4030 | 5.4 | Mar 6 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting Affected: 8.5; 9.0 |
| CVE-2018-1777 | 5.4 | Oct 16 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.14; 9.0.0.0 through 9.0.0.9 |
| CVE-2017-1380 | 5.4 | Jul 24 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting Affected: 7.0.0.0 through 7.0.0.43; 8.0.0.0 through 8.0.0.13; 8.5.0.0 through 8.5.5.11; 9.0.0.0 through 9.0.0.4 |
| CVE-2017-1121 | 5.4 | Feb 13 | IBM WebSphere Application Server 7.0, 8.0, and 9.0 is vulnerable to cross-site scripting Affected: 7.0; 8.0; 8.5; 8.5.5; 9.0 |
| CVE-2016-8934 | 5.4 | Feb 1 | IBM WebSphere Application Server is vulnerable to cross-site scripting Affected: 8.5.5.0; 8.5.5.0; 8.5.5.1; 8.5.5.1; 8.5.5.2; 8.5.5.2; +16 more |
| CVE-2016-3042 | 5.4 | Oct 1 | Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Application Server (WAS) Liberty before 16.0.0.3 allows remote authenticated users to inject arbitrary web… Affected: All versions, or not specified |
| CVE-2015-7417 | 5.4 | Jan 23 | Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server 7.0 before 7.0.0.41, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.9 allows remote authenticated users to… Affected: 7.0.0.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; 7.0.0.5; +34 more |
| CVE-2026-11540 | 5.3 | Sep 18 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-11539 | 5.3 | Sep 18 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-11538 | 5.3 | Sep 18 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-16188 | 5.3 | Sep 14 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-9667 | 5.3 | Sep 10 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-9338 | 5.3 | Sep 10 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-10571 | 5.3 | Aug 13 | IBM WebSphere Application Server Liberty is affected by a denial of service Affected: 17.0.0.3 before 26.0.0.9 |
| CVE-2022-39161 | 5.3 | May 3 | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and IBM WebSphere Application Server Liberty, when configured to communicate with the Web Server Plug-ins for IBM WebSphere… Affected: 7.0; 8.0; 8.5; 9.0 |
| CVE-2022-22473 | 5.3 | Jul 14 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of Administrative Console data Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.21; 9.0.0.0 through 9.0.5.12 |
| CVE-2021-29842 | 5.3 | Sep 16 | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference of responses from… Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5 through 8.5.5.20; 9.0.0.0 through 9.0.5.9; 17.0.0.3 through 21.0.0.9 |
| CVE-2020-10693 | 5.3 | May 6 | A flaw was found in Hibernate Validator version 6.1.2.Final Affected: 17.0.0.3 through 20.0.0.10 |
| CVE-2019-4441 | 5.3 | Oct 3 | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.16; 9.0.0.0 through 9.0.5.1; 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; +3 more |
| CVE-2019-4305 | 5.3 | Sep 30 | IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie Affected: before 19.0.0.10 |
| CVE-2019-4505 | 5.3 | Sep 20 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Network Deployment could allow a remote attacker to obtain sensitive information, caused by sending a specially-crafted URL Affected: 8.5.0.0 through 8.5.5.16; 9.0.0.0 through 9.0.5.0 |
| CVE-2019-4268 | 5.3 | Sep 17 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.16; 9.0.0.0 through 9.0.5.0 |
| CVE-2018-1996 | 5.3 | Feb 19 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security, caused by the improper TLS configuration Affected: 7.0; 8.0; 8.5; 9.0 |
| CVE-2017-1788 | 5.3 | Mar 22 | IBM WebSphere Application Server 9 installations using Form Login could allow a remote attacker to conduct spoofing attacks Affected: 9.0.0.0 through 9.0.0.7 |
| CVE-2016-9736 | 5.3 | Jun 8 | IBM WebSphere Application Server using malformed SOAP requests could allow a remote attacker to obtain sensitive information Affected: 8.0; 8.5; 9.0 |
| CVE-2016-0389 | 5.3 | Jul 7 | Admin Center in IBM WebSphere Application Server (WAS) 8.5.5.2 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote attackers to obtain sensitive information via… Affected: 8.5.5.2; 8.5.5.3; 8.5.5.4; 8.5.5.5; 8.5.5.6; 8.5.5.7; +2 more |
| CVE-2025-13333 | 4.9 | Feb 17 | IBM WebSphere Application Server could provide weaker than expected security Affected: 9.0 through 9.0.5.27; 8.5 through 8.5.5.29 |
| CVE-2025-36099 | 4.9 | Sep 29 | IBM WebSphere Application Server denial of service Affected: 8.5; 9.0 |
| CVE-2026-11722 | 4.8 | Sep 18 | IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling Affected: 9.0; 8.5 |
| CVE-2026-11548 | 4.8 | Sep 18 | IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling Affected: 9.0; 8.5 |
| CVE-2026-10841 | 4.8 | Sep 18 | IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling Affected: 9.0; 8.5 |
| CVE-2026-16189 | 4.8 | Sep 14 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2025-36000 | 4.8 | Aug 12 | IBM WebSphere Application Server Liberty cross-site scripting Affected: 17.0.0.3 through 25.0.0.8 |
| CVE-2024-45087 | 4.8 | Nov 11 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting Affected: 8.5; 9.0 |
| CVE-2024-45071 | 4.8 | Oct 16 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting Affected: 8.5.0.0 through 8.5.5.26; 9.0.0.0 through 9.0.5.21 |
| CVE-2024-45073 | 4.8 | Sep 30 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting Affected: 8.5; 9.0 |
| CVE-2024-35153 | 4.8 | Jun 27 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting Affected: 8.5.0.0 before 8.5.5.26; 9.0.0.0 before 9.0.5.21 |
| CVE-2026-11537 | 4.3 | Sep 18 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2024-22329 | 4.3 | Apr 17 | IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3 are vulnerable to server-side request forgery (SSRF) Affected: 8.5.0.0 before 8.5.5.26; 9.0.0.0 before 9.0.5.20; 17.0.0.3 before 24.0.0.4 |
The 500 most important CVEs for this product (exploited first, then by severity)