IBM Websphere Application Server Liberty vulnerabilities, page 2
44 vulnerabilities
Known vulnerabilities in IBM Websphere Application Server Liberty, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-11897ibmwebsphere_application_server+1
EPSS score0.53%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.CVE-2026-11714ibmwebsphere_application_server+1EPSS score0.36%
IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled.CVE-2026-11546ibmwebsphere_application_server+1EPSS score0.40%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.CVE-2026-9320ibmwebsphere_application_server+1EPSS score0.56%
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.CVE-2026-9322ibmwebsphere_application_server+1EPSS score0.56%
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request.CVE-2026-9071ibmwebsphere_application_server+1EPSS score0.62%
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.CVE-2026-14525ibmwebsphere_application_server+1EPSS score0.55%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.CVE-2026-14529ibmwebsphere_application_server+1EPSS score0.53%
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled.CVE-2026-14976ibmwebsphere_application_server+1EPSS score0.61%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.CVE-2026-14981ibmwebsphere_application_server+1EPSS score0.46%
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits.CVE-2026-14980ibmwebsphere_application_server+1EPSS score0.43%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.CVE-2026-4410ibmwebsphere_application_server+1EPSS score0.50%
IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.CVE-2026-18499ibmwebsphere_application_server+1EPSS score0.42%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.CVE-2026-5516ibmwebsphere_application_server+1EPSS score0.30%
IBM WebSphere Application Server - Liberty 22.0.0.11 through 26.0.0.5 IBM WebSphere Application Server Liberty could allow a remote attacker to bypass security under limited conditions by exploiting a specific timing window.CVE-2026-10571ibmwebsphere_application_server+1EPSS score0.59%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.CVE-2026-10842ibmwebsphere_application_server+1EPSS score0.53%
IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints.CVE-2026-15280ibmwebsphere_application_server+1EPSS score0.50%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism.CVE-2026-15064ibmwebsphere_application_server+1EPSS score0.34%
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.CVE-2026-15057ibmwebsphere_application_server+1EPSS score0.46%
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation.CVE-2026-15328ibmwebsphere_application_server+1EPSS score0.39%
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling.