Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-9072 | 9.8 critical | 1.0% | ibm, i | IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intelligent Management with the WebSphere WebServer Plug-in component - are vulnerable to remote code execution and denial of service. This vulnerability can be exploited when an attacker impersonates backend servers and sends crafted responses to the plug-in. | Sun 25 Oct |
| CVE-2026-14446 | 9.8 critical | 1.0% | ibm, websphere_application_server | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console. | Fri 23 Oct |
| CVE-2026-14512 | 9.8 critical | 1.0% | ibm, websphere_application_server | IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code. | Fri 23 Oct |
| CVE-2026-14974 | 9.8 critical | 1.0% | ibm, websphere_application_server | IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data. | Fri 23 Oct |
| CVE-2026-14976 | 9.8 critical | 1.0% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled. | Fri 23 Oct |
| CVE-2026-11536 | 8.5 high | 1.0% | ibm, websphere_application_server | IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector. | Fri 23 Oct |
| CVE-2026-11595 | 7.5 high | 1.0% | ibm, websphere_application_server | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the administrative console's integrated help system. | Sun 25 Oct |
| CVE-2026-9171 | 7.5 high | 1.0% | ibm, powervm_novalink | IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. | Sat 24 Oct |
| CVE-2026-15280 | 7.5 high | 1.0% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism. | Fri 23 Oct |
| CVE-2026-11897 | 7.5 high | 1.0% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. | Fri 23 Oct |
| CVE-2026-4410 | 7.5 high | 1.0% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. | 14 Oct |
| CVE-2026-11546 | 9.8 critical | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled. | Sun 25 Oct |
| CVE-2026-11714 | 9.8 critical | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled. | Sun 25 Oct |
| CVE-2026-11541 | 9.8 critical | 0.00% | ibm, websphere_application_server | IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability. | Sun 25 Oct |
| CVE-2026-16184 | 9.8 critical | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request. | Fri 23 Oct |
| CVE-2026-11708 | 9.3 critical | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system. | Sun 25 Oct |
| CVE-2026-11712 | 9.3 critical | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system. | Sun 25 Oct |
| CVE-2026-11707 | 9.3 critical | 0.00% | ibm, websphere_application_server, tivoli_system_automation_application_manager | IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page. | Fri 23 Oct |
| CVE-2026-9006 | 9.1 critical | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure. | Sun 25 Oct |
| CVE-2026-93909 | 9.1 critical | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled. | Thu 22 Oct |
| CVE-2026-93895 | 9.1 critical | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods. | Thu 22 Oct |
| CVE-2026-95695 | 9.1 critical | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization. | Thu 22 Oct |
| CVE-2026-8858 | 8.8 high | 0.00% | ibm, i | IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote code execution and denial of service in the WebSphere Web Server Plug-in component. This vulnerability can be exploited when an attacker impersonates the application server and sends crafted responses to the plug-in. | Sun 25 Oct |
| CVE-2026-2482 | 8.8 high | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. | Sat 24 Oct |
| CVE-2026-14980 | 8.8 high | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled. | Fri 23 Oct |
| CVE-2026-101294 | 8.7 high | 0.00% | no CPE yet | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature. | 14 Oct |
| CVE-2026-93905 | 8.2 high | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances. | Thu 22 Oct |
| CVE-2026-105443 | 8.2 high | 0.00% | no CPE yet | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install. | 16 Oct |
| CVE-2026-18499 | 8.1 high | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives. | Fri 23 Oct |
| CVE-2026-93907 | 8.1 high | 0.00% | no CPE yet | IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler. | 14 Oct |
| CVE-2026-95680 | 8.0 high | 0.00% | no CPE yet | IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell. | 14 Oct |
| CVE-2026-10852 | 7.5 high | 0.00% | ibm, i | IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to denial of service in the WebSphere WebServer Plug-in component when an attacker can pass crafted requests to the web server. | Sun 25 Oct |
| CVE-2026-11806 | 7.5 high | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled. | Sun 25 Oct |
| CVE-2026-14528 | 7.5 high | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information. | Fri 23 Oct |
| CVE-2026-15057 | 7.5 high | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation. | Fri 23 Oct |
| CVE-2026-95696 | 7.5 high | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception. | Thu 22 Oct |
| CVE-2026-105442 | 7.5 high | 0.00% | no CPE yet | IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service. | 14 Oct |
| CVE-2026-103499 | 7.5 high | 0.00% | no CPE yet | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption. | 13 Oct |
| CVE-2026-10845 | 7.3 high | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications. | Sun 25 Oct |
| CVE-2026-9002 | 6.5 medium | 0.00% | ibm, websphere_extreme_scale | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 could allow an adjacent attacker to cause a denial of service due to improper validation in the XDF decoder. The application processes deeply nested Protocol Buffers messages and attacker-controlled length prefixes without sufficient bounds checking, which may allow an attacker on the same network to trigger a StackOverflowError or OutOfMemoryError, resulting in a crash of the WebSphere Application Server JVM. | Sun 25 Oct |
| CVE-2026-16192 | 6.5 medium | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled. | Fri 23 Oct |
| CVE-2026-15396 | 6.5 medium | 0.00% | no CPE yet | IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks. | Thu 22 Oct |
| CVE-2026-15412 | 6.5 medium | 0.00% | no CPE yet | IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. | Thu 22 Oct |
| CVE-2026-15634 | 6.5 medium | 0.00% | no CPE yet | IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks. | Thu 22 Oct |
| CVE-2026-11549 | 6.5 medium | 0.00% | no CPE yet | IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by a virtual host bypass vulnerability. | Thu 22 Oct |
| CVE-2026-77816 | 6.5 medium | 0.00% | no CPE yet | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information. | 14 Oct |
| CVE-2026-14909 | 6.5 medium | 0.00% | no CPE yet | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled. | 14 Oct |
| CVE-2026-11594 | 6.1 medium | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console. | Sun 25 Oct |
| CVE-2026-14515 | 6.1 medium | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack. | Fri 23 Oct |
| CVE-2026-3621 | 5.9 medium | 0.00% | ibm, websphere_application_server | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.4 IBM WebSphere Application Server Liberty is vulnerable to identity spoofing under limited conditions when an application is deployed without authentication and authorization configured. | Mon 26 Oct |
50 of 59 · Next
Download these 59 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.