WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product application server✕
Overview 1,162 matches · 706 in Waratek scope · 71 protected · 20 exploited · 11 CISA KEV · 81 public PoC · 22 EPSS ≥ 0.5
split by peak 91 / year
Not applicable: 395Outside Waratek scope: 61No exploit published: 614Mitigation candidate: 21Protected by Waratek: 71 Low: 68Medium: 579High: 421Critical: 94 not blocked: 1,091blocked by ARMR today: 71 No public exploit: 1,070Forecast only: 4Proof of concept only: 12Working exploit published: 56Exploited: 20
19991 No exploit published1 High1 not blocked1 No public exploit1 20006 Mitigation candidate1 No exploit published1 Outside Waratek scope1 Not applicable3 High4 Medium2 not blocked6 Working exploit published3 No public exploit3 200113 Protected by Waratek1 Mitigation candidate1 No exploit published5 Outside Waratek scope2 Not applicable4 High8 Medium5 blocked by ARMR today1 not blocked12 Working exploit published4 Forecast only1 No public exploit8 200237 Protected by Waratek1 No exploit published13 Outside Waratek scope6 Not applicable17 High14 Medium22 Low1 blocked by ARMR today1 not blocked36 Working exploit published6 Forecast only2 No public exploit29 200310 No exploit published1 Not applicable9 High6 Medium3 Low1 not blocked10 Working exploit published3 No public exploit7 200419 Mitigation candidate1 No exploit published5 Outside Waratek scope2 Not applicable11 Critical1 High9 Medium8 Low1 not blocked19 Working exploit published4 No public exploit15 200539 Mitigation candidate1 No exploit published16 Not applicable22 High14 Medium24 Low1 not blocked39 Working exploit published9 No public exploit30 200678 Protected by Waratek2 Mitigation candidate1 No exploit published50 Outside Waratek scope10 Not applicable15 High46 Medium28 Low4 blocked by ARMR today2 not blocked76 Working exploit published7 No public exploit71 200783 Protected by Waratek1 Mitigation candidate1 No exploit published46 Not applicable35 High41 Medium37 Low5 blocked by ARMR today1 not blocked82 Exploited1 Working exploit published3 No public exploit79 200848 Mitigation candidate2 No exploit published30 Outside Waratek scope7 Not applicable9 High22 Medium22 Low4 not blocked48 Working exploit published4 No public exploit44 200970 Mitigation candidate1 No exploit published58 Outside Waratek scope2 Not applicable9 High15 Medium46 Low9 not blocked70 Working exploit published1 No public exploit69 201038 Protected by Waratek1 No exploit published30 Outside Waratek scope2 Not applicable5 High7 Medium25 Low6 blocked by ARMR today1 not blocked37 Working exploit published2 No public exploit36 201131 Protected by Waratek1 Mitigation candidate2 No exploit published26 Outside Waratek scope1 Not applicable1 High4 Medium24 Low3 blocked by ARMR today1 not blocked30 Working exploit published2 No public exploit29 201232 Protected by Waratek1 No exploit published25 Not applicable6 High4 Medium24 Low4 blocked by ARMR today1 not blocked31 No public exploit32 201328 Protected by Waratek1 No exploit published24 Outside Waratek scope2 Not applicable1 High3 Medium17 Low8 blocked by ARMR today1 not blocked27 No public exploit28 201433 Protected by Waratek2 No exploit published27 Not applicable4 High2 Medium25 Low6 blocked by ARMR today2 not blocked31 No public exploit33 201520 Mitigation candidate1 No exploit published15 Not applicable4 High5 Medium15 not blocked20 Exploited1 No public exploit19 201629 Protected by Waratek1 Mitigation candidate1 No exploit published14 Outside Waratek scope2 Not applicable11 Critical5 High9 Medium12 Low3 blocked by ARMR today1 not blocked28 Exploited6 Working exploit published2 No public exploit21 201728 Protected by Waratek1 No exploit published13 Outside Waratek scope4 Not applicable10 Critical1 High12 Medium14 Low1 blocked by ARMR today1 not blocked27 Exploited1 Working exploit published2 Proof of concept only1 No public exploit24 201859 Protected by Waratek10 No exploit published30 Outside Waratek scope10 Not applicable9 Critical8 High23 Medium28 blocked by ARMR today10 not blocked49 Exploited1 Working exploit published2 Proof of concept only1 Forecast only1 No public exploit54 201961 Protected by Waratek7 No exploit published20 Outside Waratek scope3 Not applicable31 Critical11 High14 Medium34 Low2 blocked by ARMR today7 not blocked54 Exploited1 Working exploit published2 No public exploit58 202091 Protected by Waratek13 Mitigation candidate6 No exploit published32 Outside Waratek scope7 Not applicable33 Critical13 High41 Medium34 Low3 blocked by ARMR today13 not blocked78 Exploited5 Proof of concept only6 No public exploit80 202164 Protected by Waratek12 Mitigation candidate2 No exploit published16 Not applicable34 Critical4 High29 Medium31 blocked by ARMR today12 not blocked52 Exploited1 Proof of concept only3 No public exploit60 202239 No exploit published14 Not applicable25 Critical3 High14 Medium22 not blocked39 Exploited1 Proof of concept only1 No public exploit37 202352 Protected by Waratek1 No exploit published10 Not applicable41 Critical15 High8 Medium29 blocked by ARMR today1 not blocked51 Exploited1 No public exploit51 202435 Protected by Waratek3 No exploit published16 Not applicable16 Critical1 High14 Medium18 Low2 blocked by ARMR today3 not blocked32 No public exploit35 202528 Protected by Waratek1 No exploit published10 Not applicable17 Critical4 High11 Medium10 Low3 blocked by ARMR today1 not blocked27 No public exploit28 202690 Protected by Waratek11 No exploit published66 Not applicable13 Critical28 High41 Medium20 Low1 blocked by ARMR today11 not blocked79 Exploited1 No public exploit89
1999200220052008201120142017202020232026
1,162 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 12 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-95696 High 2026-10-13 No exploit published No public exploit IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
CVE-2026-95695 Critical 2026-10-13 No exploit published No public exploit IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
CVE-2026-93909 Critical 2026-10-13 No exploit published No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
CVE-2026-93905 High 2026-10-13 Protected by Waratek No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
CVE-2026-93895 Critical 2026-10-13 No exploit published No public exploit IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
CVE-2026-11538 Medium 2026-09-18 No exploit published No public exploit IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies.
CVE-2026-10841 Medium 2026-09-18 No exploit published No public exploit IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling.
CVE-2026-83465 High 2026-09-15 No exploit published No public exploit Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Application Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Mobile Application Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Mobile Application Server as well as unauthorized update, insert or delete access to some of Oracle Mobile Application Server accessible data. CVSS 3.1 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:H).
CVE-2026-83464 High 2026-09-15 No exploit published No public exploit Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Application Server. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-83463 High 2026-09-15 No exploit published No public exploit Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Mobile Application Server executes to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Application Server. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-83462 Critical 2026-09-15 No exploit published No public exploit Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Application Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-83461 High 2026-09-15 No exploit published No public exploit Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Mobile Application Server. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L).
CVE-2026-9667 Medium 2026-09-10 No exploit published No public exploit IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints.
CVE-2026-9338 Medium 2026-09-10 No exploit published No public exploit IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to trigger excessive resource consumption, potentially leading to reduced availability of the affected service.
CVE-2026-9336 High 2026-09-10 No exploit published No public exploit IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted HTTP request to an administrative endpoint. A remote attacker could exploit this vulnerability to cause the server to exhaust filesystem space.
CVE-2026-9327 High 2026-09-10 No exploit published No public exploit IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service.
CVE-2026-9176 High 2026-09-10 No exploit published No public exploit IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources.
CVE-2026-20320 High 2026-08-19 Not applicable Exploited A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML entries are improperly parsed due to external entity resolution being allowed by default. An attacker could exploit this vulnerability by sending a crafted XML message to the Open Client Interface – Provisioning (OCI-P) service. A successful exploit could allow the attacker to view sensitive files from the filesystem with the privileges of the Cisco BroadWorks user.
CVE-2026-70732 Medium 2026-08-18 No exploit published No public exploit Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVE-2026-14525 Critical 2026-08-13 No exploit published No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.
CVE-2026-10571 Medium 2026-08-13 Protected by Waratek No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.
CVE-2026-18499 High 2026-08-12 No exploit published No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.
CVE-2026-8400 Critical 2026-08-05 Protected by Waratek No public exploit IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes.
CVE-2026-9322 High 2026-07-30 No exploit published No public exploit IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request.
CVE-2026-14980 High 2026-07-30 No exploit published No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.
CVE-2026-11897 High 2026-07-30 No exploit published No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
CVE-2026-11707 Critical 2026-07-30 No exploit published No public exploit IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page.
CVE-2026-11536 High 2026-07-30 Protected by Waratek No public exploit IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.
CVE-2026-11383 Medium 2026-07-30 No exploit published No public exploit IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console.
CVE-2026-10842 High 2026-07-30 No exploit published No public exploit IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints.
CVE-2026-2482 High 2026-07-29 No exploit published No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CVE-2026-14529 Critical 2026-07-29 No exploit published No public exploit IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled.
CVE-2026-16192 High 2026-07-28 No exploit published No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled.
CVE-2026-16184 Critical 2026-07-28 No exploit published No public exploit IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request.
CVE-2026-15328 High 2026-07-28 No exploit published No public exploit IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling.
CVE-2026-15325 High 2026-07-28 No exploit published No public exploit IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE requests.
CVE-2026-15280 High 2026-07-28 Protected by Waratek No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism.
CVE-2026-15064 High 2026-07-28 No exploit published No public exploit IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.
CVE-2026-15057 High 2026-07-28 No exploit published No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation.
CVE-2026-14981 High 2026-07-28 No exploit published No public exploit IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits.
CVE-2026-14976 Critical 2026-07-28 No exploit published No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.
CVE-2026-14974 Critical 2026-07-28 Protected by Waratek No public exploit IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.
CVE-2026-14528 High 2026-07-28 No exploit published No public exploit IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information.
CVE-2026-14515 Medium 2026-07-28 No exploit published No public exploit IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack.
CVE-2026-14512 Critical 2026-07-28 Protected by Waratek No public exploit IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.
CVE-2026-14446 Critical 2026-07-28 No exploit published No public exploit IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console.
CVE-2026-61226 High 2026-07-21 No exploit published No public exploit Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: RTP Proxy). The supported version that is affected is 8.3. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Communications Converged Application Server executes to compromise Oracle Communications Converged Application Server. While the vulnerability is in Oracle Communications Converged Application Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Converged Application Server. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-61225 High 2026-07-21 No exploit published No public exploit Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Core). Supported versions that are affected are 8.2 and 8.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP/IP to compromise Oracle Communications Converged Application Server. Successful attacks of this vulnerability can result in takeover of Oracle Communications Converged Application Server. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-61224 High 2026-07-21 No exploit published No public exploit Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Security). The supported version that is affected is 8.3. Difficult to exploit vulnerability allows high privileged attacker with network access via TLS to compromise Oracle Communications Converged Application Server. While the vulnerability is in Oracle Communications Converged Application Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Converged Application Server. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-61223 Critical 2026-07-21 No exploit published No public exploit Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Security). Supported versions that are affected are 8.2 and 8.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP/IP to compromise Oracle Communications Converged Application Server. While the vulnerability is in Oracle Communications Converged Application Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Converged Application Server. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-11806 High 2026-06-30 No exploit published No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled.
CVE-2026-11714 Critical 2026-06-30 No exploit published No public exploit IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled.
CVE-2026-11712 Critical 2026-06-30 No exploit published No public exploit IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system.
CVE-2026-11708 Critical 2026-06-30 No exploit published No public exploit IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system.
CVE-2026-11595 High 2026-06-30 Protected by Waratek No public exploit IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the administrative console's integrated help system.
CVE-2026-11594 High 2026-06-30 No exploit published No public exploit IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console.
CVE-2026-11546 Critical 2026-06-30 No exploit published No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.
CVE-2026-11541 Critical 2026-06-30 No exploit published No public exploit IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.
CVE-2026-9320 High 2026-06-22 No exploit published No public exploit IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
CVE-2026-9071 High 2026-06-22 No exploit published No public exploit IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
CVE-2026-9006 Critical 2026-06-22 No exploit published No public exploit IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure.
CVE-2026-8646 Critical 2026-06-22 No exploit published No public exploit IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowing the attacker to bypass security controls, spoof identity, escalate privilege, and expose sensitive information.
CVE-2026-10845 High 2026-06-22 No exploit published No public exploit IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications.
CVE-2026-9330 High 2026-06-01 Protected by Waratek No public exploit IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deserialization using the SAML Web Single Sign-On component. This could result in remote code execution via a crafted HTTP request when combined with a suitable gadget chain.
CVE-2026-9319 Critical 2026-06-01 Protected by Waratek No public exploit IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security.
CVE-2026-9311 Critical 2026-06-01 No exploit published No public exploit IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to remote code execution caused by the bypass of security controls.
CVE-2026-8644 Critical 2026-06-01 No exploit published No public exploit IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to identity spoofing.
CVE-2026-5516 Medium 2026-05-27 No exploit published No public exploit IBM WebSphere Application Server - Liberty 22.0.0.11 through 26.0.0.5 IBM WebSphere Application Server Liberty could allow a remote attacker to bypass security under limited conditions by exploiting a specific timing window.
CVE-2026-4410 High 2026-05-27 No exploit published No public exploit IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
CVE-2026-8633 Critical 2026-05-26 No exploit published No public exploit IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to remote code execution in the Web Server Plug-ins, through a specially crafted request.
CVE-2026-8620 High 2026-05-26 No exploit published No public exploit IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to HTTP request smuggling in the Web Server Plug-ins through a specially crafted request.
CVE-2026-27680 Medium 2026-05-14 Not applicable No public exploit Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets (CSS) data into a web page served by the application. When a user accesses or clicks the affected page, the injected CSS is executed. As a result, the issue has a low impact on confidentiality, while integrity and availability are not impacted.
CVE-2026-40135 Medium 2026-05-12 Not applicable No public exploit An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with administrative access to execute specially crafted shell commands on the server, bypassing the logging mechanism. This allows the execution of unintended OS commands without detection, potentially impacting the integrity and availability of the application, with no impact on confidentiality.
CVE-2026-27682 Medium 2026-05-12 Not applicable No public exploit Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages), an unauthenticated attacker could craft a URL that exploits an unprotected URL parameter to embed a malicious script. If a victim clicks the link, the injected input is processed during web page generation, resulting in the execution of malicious content in the victim�s browser context. This could allow the attacker to access and/or modify information, impacting the confidentiality and integrity of the application, with no impact to availability.
CVE-2026-3621 High 2026-04-23 No exploit published No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.4 IBM WebSphere Application Server Liberty is vulnerable to identity spoofing under limited conditions when an application is deployed without authentication and authorization configured.
CVE-2026-34257 Medium 2026-04-14 Not applicable No public exploit Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, if accessed by a victim, they could be redirected to the page controlled by the attacker. This causes low impact on confidentiality and integrity of the application with no impact on availability.
CVE-2026-27674 Medium 2026-04-14 Not applicable No public exploit Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that is interpreted by the application and causes it to reference attacker-controlled content. If a victim accesses the affected functionality, that attacker-controlled content could be executed in the victim�s browser, potentially resulting in session compromise. This could allow the attacker to execute arbitrary client-side code, impacting the confidentiality and integrity of the application, with no impact to availability.
CVE-2026-1561 Medium 2026-03-25 No exploit published No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is vulnerable to server-side request forgery (SSRF). This may allow remote attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
CVE-2025-14917 Critical 2026-03-25 No exploit published No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings.
CVE-2025-14915 High 2026-03-25 No exploit published No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is affected by privilege escalation. A privileged user could gain additional access to the application server.
CVE-2026-27688 Medium 2026-03-10 Not applicable No public exploit Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected.
CVE-2026-24316 Medium 2026-03-10 Not applicable No public exploit SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external endpoints. The report is therefore vulnerable to Server-Side Request Forgery (SSRF). Successful exploitation could lead to interaction with potentially sensitive internal endpoints, resulting in a low impact on data confidentiality and integrity. There is no impact on availability of the application.
CVE-2026-24310 Medium 2026-03-10 Not applicable No public exploit Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module and read the sensitive information from database catalog of the ABAP system. This vulnerability has low impact on the application's confidentiality with no effect on the integrity and availability.
CVE-2026-24309 Medium 2026-03-10 Not applicable No public exploit Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module to read, modify or insert entries into the database configuration table of the ABAP system. This unauthorized content change could lead to reduced system performance or interruptions. The vulnerability has low impact on the application's integrity and availability, with no effect on confidentiality.
CVE-2025-14923 Critical 2026-03-03 No exploit published No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.2 IBM WebSphere Application Server Liberty could provide weaker than expected security when using the Security Utility when administering security settings.
CVE-2025-13333 Medium 2026-02-17 No exploit published No public exploit IBM WebSphere Application Server 9.0, and 8.5 could provide weaker than expected security during system administration of security settings.
CVE-2026-23686 Low 2026-02-10 Not applicable No public exploit Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially crafted content to the application. If processed by the application, this content enables injection of untrusted entries into generated configuration, allowing manipulation of application-controlled settings. Successful exploitation leads to a low impact on integrity, while confidentiality and availability remain unaffected.
CVE-2026-0488 Critical 2026-02-10 Not applicable No public exploit An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability.
CVE-2025-14914 High 2026-02-02 Protected by Waratek No public exploit IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive containing path traversal sequences resulting in an overwrite of files leading to arbitrary code execution.
CVE-2026-0506 High 2026-01-13 Not applicable No public exploit Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to execute form routines (FORMs) in the ABAP system. Successful exploitation could allow the attacker to write or modify data accessible via FORMs and invoke system functionality exposed via FORMs, resulting in a high impact on integrity and availability, while confidentiality remains unaffected.
CVE-2025-12635 Medium 2025-12-08 No exploit published No public exploit IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to improper validation of user-supplied input. An attacker could exploit this vulnerability by using a specially crafted URL to redirect the user to a malicious site.
CVE-2025-54563 High 2025-11-24 Not applicable No public exploit An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Incorrect Access Control, leading to Remote Information Disclosure.
CVE-2025-54347 Critical 2025-11-24 Not applicable No public exploit A Directory Traversal vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to write arbitrary files under certain conditions.
CVE-2025-54341 Medium 2025-11-24 Not applicable No public exploit A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There are Hard-coded configuration values.
CVE-2025-54338 High 2025-11-24 Not applicable No public exploit An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to disclose user hashes.
CVE-2025-54562 Medium 2025-11-14 Not applicable No public exploit A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Technical Information to be Disclosed through stack trace.
CVE-2025-54561 Medium 2025-11-14 Not applicable No public exploit An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote access to content despite lack of the correct permission through a Broken Authorization Schema.
CVE-2025-54560 Low 2025-11-14 Not applicable No public exploit A Server-side Request Forgery vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Probing of internal infrastructure.
CVE-2025-54559 Low 2025-11-14 Not applicable No public exploit An issue was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote Path Traversal for loading arbitrary external content.
CVE-2025-54348 Medium 2025-11-14 Not applicable No public exploit A Stored Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows an attacker to hijack user’s browser, capturing sensitive information.
‹ prev page 1 of 12 next ›