WA
Product
WebSphere Application Server Liberty
On CISA KEVExploited in the wild
533
CVEs
1
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 38High 96Medium 123Low 9
Watch
Add WebSphere Application Server Liberty to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-11545 | 3.7 | Sep 18 | IBM WebSphere Application Server is affected by a privilege escalation Affected: 8.5; 9.0 |
| CVE-2016-0378 | 3.7 | Nov 24 | IBM WebSphere Application Server (WAS) Liberty before 16.0.0.3, when the installation lacks a default error page, allows remote attackers to obtain sensitive information by… Affected: through 16.0.0.2 |
| CVE-2016-2960 | 3.7 | Aug 8 | IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.0.x before 8.0.0.13, 8.5.0.x before 8.5.5.10, 8.5.0.x and 16.0.0.x Liberty before Liberty Fix Pack 16.0.0.3, and… Affected: 7.0; 7.0.0.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; +34 more |
| CVE-2019-4271 | 3.5 | Sep 17 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin console is vulnerable to a Client-side HTTP parameter pollution vulnerability Affected: 8.5.0.0 through 8.5.5.15; 9.0.0.0 through 9.0.0.11; 7.0.0.0 |
| CVE-2020-4629 | 3.3 | Sep 30 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local user with specialized access to obtain sensitive information from a detailed technical error message Affected: 7.0.0.0 through 7.0.0.45; 7.0.0.0 through 7.0.0.45; 8.0.0.0 through 8.0.0.15; 8.0.0.0 through 8.0.0.15; 8.5.0.0 through 8.5.5.18; 8.5.0.0 through 8.5.5.18; +2 more |
| CVE-2017-1381 | 3.3 | Jul 21 | IBM WebSphere Application Server Proxy Server or On-demand-router (ODR) 7.0, 8.0, 8.5, 9.0 and could allow a local attacker to obtain sensitive information, caused by stale data… Affected: 7.0.0.0 through 7.0.0.43; 8.0.0.0 through 8.0.0.13; 8.5.0.0 through 8.5.5.12; 9.0.0.0 through 9.0.0.4 |
| CVE-2026-16190 | 3.1 | Sep 14 | IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities Affected: 9.0; 8.5 |
| CVE-2016-0385 | 3.1 | Sep 1 | Buffer overflow in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.10, 9.0 before 9.0.0.1, and Liberty before 16.0.0.3, when… Affected: 7.0; 7.0.0.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.0.4; +34 more |
| CVE-2025-27907 | 2.7 | Apr 22 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF) Affected: 8.5 before 8.5.5.28; 9.0 before 9.0.5.24 |
Showing 9
The 500 most important CVEs for this product (exploited first, then by severity)