WA
Product
WebSphere Application Server Liberty
On CISA KEVExploited in the wild
533
CVEs
1
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 38High 96Medium 123Low 9
Watch
Add WebSphere Application Server Liberty to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-14980 | 8.8 | Jul 30 | IBM WebSphere Application Server Liberty is affected by a cross-site request forgery Affected: 17.0.0.3 before 26.0.0.9 |
| CVE-2026-2482 | 8.8 | Jul 29 | IBM WebSphere Application Server Liberty is affected by a cross-site request forgery Affected: 17.0.0.3 before 26.0.0.9 |
| CVE-2026-8858 | 8.8 | Jun 22 | WebSphere Application Server Remote Code Execution Affected: 8.5; 9.0 |
| CVE-2024-37532 | 8.8 | Jun 20 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to identity spoofing by an authenticated user due to improper signature validation Affected: 8.5.0.0; 9.0.0.0 |
| CVE-2022-22476 | 8.8 | Jul 8 | IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty are vulnerable to identity spoofing by an authenticated user using a specially crafted request Affected: 17.0.0.3 before 22.0.0.8 |
| CVE-2021-39031 | 8.8 | Jan 25 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to conduct an LDAP injection Affected: 17.0.0.3 through 22.0.0.1 |
| CVE-2021-29736 | 8.8 | Jul 30 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote user to gain elevated privileges on the system Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.20; 9.0.0.0 through 9.0.5.8 |
| CVE-2021-29754 | 8.8 | Jun 11 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a privilege escalation vulnerability when using the SAML Web Inbound Trust Association Interceptor (TAI) Affected: 7.0.0.0 before 7.0.0.45; 8.0.0.0 before 8.0.0.15; 8.5.0.0 before 8.5.5.20; 9.0.0.0 before 9.0.5.8 |
| CVE-2020-4534 | 8.8 | Aug 3 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper handling of UNC… Affected: 7.0; 8.0; 8.5; 9.0 |
| CVE-2020-4464 | 8.8 | Jul 17 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with a specially-crafted sequence of… Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.17; 9.0.0.0 through 9.0.5.4 |
| CVE-2020-4362 | 8.8 | Apr 10 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-based authentication in an admin request… Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.17; 9.0.0.0 through 9.0.5.3 |
| CVE-2018-1926 | 8.8 | Dec 12 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.14; 9.0.0.0 through 9.0.0.9 |
| CVE-2018-1901 | 8.8 | Dec 12 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to temporarily gain elevated privileges on the system, caused by incorrect cached value being used Affected: 8.5.0.0 through 8.5.5.14; 9.0.0.0 through 9.0.0.9 |
| CVE-2017-1731 | 8.8 | Jan 30 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security when using the Administrative Console Affected: 7.0.0.0 through 7.0.0.43; 8.0.0.0 through 8.0.0.14; 8.5.0.0 through 8.5.5.13; 9.0.0.0 through 9.0.0.6 |
| CVE-2017-1194 | 8.8 | Apr 28 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… Affected: 7.0; 8.0; 8.5; 9.0 |
| CVE-2026-101294 | 8.7 | Oct 13 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step Affected: 8.5; 9.0 |
| CVE-2026-15064 | 8.7 | Jul 28 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-15325 | 8.7 | Jul 28 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-11536 | 8.5 | Jul 30 | IBM WebSphere Application Server is affected by a remote code execution vulnerability Affected: 9.0; 8.5 |
| CVE-2026-9330 | 8.5 | Jun 1 | IBM WebSphere Application Server is affected by remote code execution Affected: 9.0 through 1.1.9.12; 8.5 |
| CVE-2026-93905 | 8.2 | Oct 13 | IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data Affected: 17.0.0.3 before 26.0.0.11 |
| CVE-2021-20492 | 8.2 | May 26 | IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.19; 9.0.0.0 through 9.0.5.7; 17.0.0.3 through 21.0.0.5 |
| CVE-2021-20454 | 8.2 | Apr 21 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.19; 9.0.0.0 through 9.0.5.7 |
| CVE-2021-20453 | 8.2 | Apr 20 | IBM WebSphere Application Server 8.0, 8.5, and 9.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data Affected: 8.0.0.0 before 8.0.0.15; 8.5.0.0 before 8.5.5.20; 9.0.0.0 before 9.0.5.8 |
| CVE-2021-20353 | 8.2 | Feb 10 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 7.0.0.0 before 7.0.0.45; 8.0.0.0 before 8.0.0.15; 8.5.0.0 before 8.5.5.20; 9.0.0.0 before 9.0.5.7 |
| CVE-2020-4949 | 8.2 | Jan 26 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.18; 9.0.0.0 through 9.0.5.6 |
| CVE-2026-93907 | 8.1 | Oct 13 | IBM WebSphere Application Server is affected by a bypass authentication vulnerability Affected: 8.5; 9.0 |
| CVE-2026-9327 | 8.1 | Sep 10 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-18499 | 8.1 | Aug 12 | IBM WebSphere Application Server Liberty is affected by a privilege escalation Affected: 17.0.0.3 before 26.0.0.9 |
| CVE-2026-15328 | 8.1 | Jul 28 | IBM WebSphere Application Server and WebSphere Application Server Liberty is inconsistent Interpretation of HTTP Requests Affected: 9.0; 8.5 |
| CVE-2018-1840 | 8.1 | Dec 3 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to gain elevated privileges on the system, caused when a security domain is configured to use a… Affected: 8.5.0.0 through 8.5.5.14; 9.0.0.0 through 9.0.0.9 |
| CVE-2017-1137 | 8.1 | May 10 | IBM WebSphere Application Server 8.0 and 8.5.5 could provide weaker than expected security Affected: 8.0; 8.5; 8.5.5 |
| CVE-2017-1151 | 8.1 | Mar 20 | IBM WebSphere Application Server 8.0, 8.5, 8.5.5, and 9.0 using OpenID Connect (OIDC) configured with a Trust Association Interceptor (TAI) could allow a user to gain elevated… Affected: 8.0; 8.5; 8.5.5; 9.0 |
| CVE-2026-95680 | 8.0 | Oct 13 | IBM WebSphere Application Server is affected by an authorization bypass Affected: 8.5; 9.0 |
| CVE-2018-1890 | 7.8 | Mar 11 | IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users Affected: 7.0; 8.0; 8.5; 9.0; Liberty |
| CVE-2013-3024 | 7.8 | May 24 | IBM WebSphere Application Server (WAS) 8.5 through 8.5.0.2 on UNIX allows local users to gain privileges by leveraging improper process initialization Affected: 8.5.0.0 through 8.5.0.2 |
| CVE-2025-14914 | 7.6 | Feb 2 | IBM WebSphere Application Server Liberty Path Traversal Affected: 17.0.0.3 through 26.0.0.1 |
| CVE-2025-33104 | 7.6 | May 14 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting Affected: 8.5 before 8.5.5.28; 9.0 before 9.0.5.24 |
| CVE-2026-95696 | 7.5 | Oct 13 | IBM WebSphere Application Server Liberty Denial of Service Affected: 20.0.0.12 before 26.0.0.11 |
| CVE-2026-105442 | 7.5 | Oct 13 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted data Affected: 8.5; 9.0 |
| CVE-2026-103499 | 7.5 | Oct 13 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service Affected: 8.5; 9.0 |
| CVE-2026-9336 | 7.5 | Sep 10 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-9322 | 7.5 | Jul 30 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-10842 | 7.5 | Jul 30 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability Affected: 8.5; 9.0 |
| CVE-2026-11897 | 7.5 | Jul 30 | IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2 Affected: 17.0.0.3 before 26.0.0.8 |
| CVE-2026-14528 | 7.5 | Jul 28 | IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information Affected: 9.0; 8.5 |
| CVE-2026-14981 | 7.5 | Jul 28 | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2026-15057 | 7.5 | Jul 28 | IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability Affected: 17.0.0.3 before 26.0.0.8 |
| CVE-2026-15280 | 7.5 | Jul 28 | IBM WebSphere Application Server Liberty is affected by a remote code execution and path-segment injection vulnerability Affected: 17.0.0.3 before 26.0.0.9 |
| CVE-2026-11595 | 7.5 | Jun 30 | IBM WebSphere Application Server is affected by a Path Traversal vulnerability Affected: 9.0; 8.5 |
The 500 most important CVEs for this product (exploited first, then by severity)