Filtered by vendor Ibm Subscriptions
Filtered by product Websphere Application Server Liberty Subscriptions
Total 24 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-77816 1 Ibm 2 Websphere Application Server Liberty, Websphere Application Server Liberty 2026-10-18 6.5 Medium
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information.
CVE-2026-11713 1 Ibm 2 Websphere Application Server Liberty, Websphere Application Server Liberty 2026-10-18 5.4 Medium
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabled.
CVE-2026-14532 1 Ibm 2 Websphere Application Server Liberty, Websphere Application Server Liberty 2026-10-17 4.3 Medium
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception.
CVE-2026-93895 1 Ibm 1 Websphere Application Server Liberty 2026-10-17 9.1 Critical
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
CVE-2026-95696 1 Ibm 1 Websphere Application Server Liberty 2026-10-16 6.5 Medium
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
CVE-2026-79715 1 Ibm 1 Websphere Application Server Liberty 2026-10-16 5.5 Medium
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive to write files outside the intended directory.
CVE-2026-105442 1 Ibm 2 Websphere Application Server, Websphere Application Server Liberty 2026-10-14 7.5 High
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service.
CVE-2026-93905 1 Ibm 1 Websphere Application Server Liberty 2026-10-14 8.2 High
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
CVE-2026-14909 1 Ibm 1 Websphere Application Server Liberty 2026-10-14 6.5 Medium
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled.
CVE-2026-101294 1 Ibm 2 Websphere Application Server, Websphere Application Server Liberty 2026-10-14 8.7 High
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature.
CVE-2026-93909 1 Ibm 1 Websphere Application Server Liberty 2026-10-14 9.1 Critical
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
CVE-2026-95695 1 Ibm 1 Websphere Application Server Liberty 2026-10-13 7.4 High
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
CVE-2026-105443 1 Ibm 1 Websphere Application Server Liberty 2026-10-13 8.2 High
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.
CVE-2026-103499 1 Ibm 2 Websphere Application Server, Websphere Application Server Liberty 2026-10-13 7.5 High
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption.
CVE-2026-10571 4 Apple, Ibm, Linux and 1 more 9 Macos, Aix, I and 6 more 2026-08-17 5.7 Medium
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.
CVE-2026-14525 4 Apple, Ibm, Linux and 1 more 8 Macos, Aix, I and 5 more 2026-08-17 9.4 Critical
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.
CVE-2026-18499 1 Ibm 2 Websphere Application Server, Websphere Application Server Liberty 2026-08-17 8.1 High
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.
CVE-2026-8400 1 Ibm 2 Websphere Application Server, Websphere Application Server Liberty 2026-08-06 8.1 High
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes.
CVE-2026-10842 1 Ibm 3 Websphere Application Server, Websphere Application Server Liberty, Websphere Application Server Liberty 2026-07-30 7.5 High
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints.
CVE-2026-14980 1 Ibm 2 Websphere Application Server, Websphere Application Server Liberty 2026-07-30 8.3 High
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.