Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-9072 | 9.8 critical | 1.0% | ibm, i | IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intelligent Management with the WebSphere WebServer Plug-in component - are vulnerable to remote code execution and denial of service. This vulnerability can be exploited when an attacker impersonates backend servers and sends crafted responses to the plug-in. | Sun 25 Oct |
| CVE-2026-14446 | 9.8 critical | 1.0% | ibm, websphere_application_server | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console. | 23 Oct |
| CVE-2026-14512 | 9.8 critical | 1.0% | ibm, websphere_application_server | IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code. | 23 Oct |
| CVE-2026-14974 | 9.8 critical | 1.0% | ibm, websphere_application_server | IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data. | 23 Oct |
| CVE-2026-14976 | 9.8 critical | 1.0% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled. | 23 Oct |
| CVE-2026-11546 | 9.8 critical | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled. | Sun 25 Oct |
| CVE-2026-11714 | 9.8 critical | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled. | Sun 25 Oct |
| CVE-2026-11541 | 9.8 critical | 0.00% | ibm, websphere_application_server | IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability. | Sun 25 Oct |
| CVE-2026-16184 | 9.8 critical | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request. | 23 Oct |
| CVE-2026-11708 | 9.3 critical | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system. | Sun 25 Oct |
| CVE-2026-11712 | 9.3 critical | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system. | Sun 25 Oct |
| CVE-2026-11707 | 9.3 critical | 0.00% | ibm, websphere_application_server, tivoli_system_automation_application_manager | IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page. | 23 Oct |
| CVE-2026-9006 | 9.1 critical | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure. | Sun 25 Oct |
| CVE-2026-93909 | 9.1 critical | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled. | 22 Oct |
| CVE-2026-93895 | 9.1 critical | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods. | 22 Oct |
| CVE-2026-95695 | 9.1 critical | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization. | 22 Oct |
16 of 16
Download these 16 as CSV · subscribe to this list.
EPSS scores: 2026-10-31. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.