Overview 506 matches · 483 in Waratek scope · 46 protected · 2 exploited · 1 CISA KEV · 14 public PoC · 3 EPSS ≥ 0.5
506matches
483in Waratek scope95.5%
46protected9.1%
2exploited0.4%
1CISA KEV0.2%
14public PoC2.8%
3EPSS ≥ 0.50.6%
Protected by Waratek
46
9.1%
Rule in development
0
0.0%
Mitigation candidate
8
1.6%
No exploit published
429
84.8%
Outside Waratek scope
23
4.5%
Not applicable
0
0.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
46
9.1%
partly blocked
0
0.0%
not blocked
460
90.9%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 67 / year
19991
No exploit published1
High1
not blocked1
No public exploit1
20003
Mitigation candidate1
No exploit published1
Outside Waratek scope1
High2
Medium1
not blocked3
Working exploit published2
No public exploit1
20016
Mitigation candidate1
No exploit published4
Outside Waratek scope1
High2
Medium4
not blocked6
Working exploit published2
No public exploit4
20021
No exploit published1
Medium1
not blocked1
No public exploit1
20031
No exploit published1
Low1
not blocked1
No public exploit1
20040
20059
Mitigation candidate1
No exploit published8
High2
Medium7
not blocked9
Working exploit published1
No public exploit8
200623
Mitigation candidate1
No exploit published21
Outside Waratek scope1
High13
Medium10
not blocked23
Working exploit published1
No public exploit22
200719
Mitigation candidate1
No exploit published18
High9
Medium10
not blocked19
Working exploit published1
No public exploit18
200815
No exploit published15
High9
Medium5
Low1
not blocked15
No public exploit15
200943
Mitigation candidate1
No exploit published41
Outside Waratek scope1
High13
Medium22
Low8
not blocked43
Working exploit published1
No public exploit42
201028
No exploit published27
Outside Waratek scope1
High4
Medium20
Low4
not blocked28
Working exploit published1
No public exploit27
201128
Protected by Waratek1
Mitigation candidate1
No exploit published25
Outside Waratek scope1
High1
Medium24
Low3
blocked by ARMR today1
not blocked27
Working exploit published1
No public exploit27
201224
Protected by Waratek1
No exploit published23
High3
Medium18
Low3
blocked by ARMR today1
not blocked23
No public exploit24
201326
Protected by Waratek1
No exploit published23
Outside Waratek scope2
High2
Medium16
Low8
blocked by ARMR today1
not blocked25
No public exploit26
201428
Protected by Waratek2
No exploit published26
High2
Medium21
Low5
blocked by ARMR today2
not blocked26
No public exploit28
201513
No exploit published13
High3
Medium10
not blocked13
No public exploit13
201616
Protected by Waratek1
No exploit published13
Outside Waratek scope2
Critical2
High4
Medium7
Low3
blocked by ARMR today1
not blocked15
Exploited1
No public exploit15
201715
No exploit published12
Outside Waratek scope3
High6
Medium8
Low1
not blocked15
No public exploit15
201830
Protected by Waratek4
No exploit published21
Outside Waratek scope5
Critical4
High10
Medium16
blocked by ARMR today4
not blocked26
No public exploit30
201918
Protected by Waratek3
No exploit published13
Outside Waratek scope2
Critical1
High2
Medium14
Low1
blocked by ARMR today3
not blocked15
Working exploit published1
No public exploit17
202025
Protected by Waratek9
Mitigation candidate1
No exploit published12
Outside Waratek scope3
Critical3
High9
Medium12
Low1
blocked by ARMR today9
not blocked16
Exploited1
Proof of concept only2
No public exploit22
202113
Protected by Waratek8
No exploit published5
High10
Medium3
blocked by ARMR today8
not blocked5
No public exploit13
202214
No exploit published14
High2
Medium12
not blocked14
No public exploit14
202310
Protected by Waratek1
No exploit published9
Critical3
High3
Medium4
blocked by ARMR today1
not blocked9
No public exploit10
202419
Protected by Waratek3
No exploit published16
High8
Medium11
blocked by ARMR today3
not blocked16
No public exploit19
202511
Protected by Waratek1
No exploit published10
Critical1
High6
Medium4
blocked by ARMR today1
not blocked10
No public exploit11
202667
Protected by Waratek11
No exploit published56
Critical25
High32
Medium10
blocked by ARMR today11
not blocked56
No public exploit67
1999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-95696 | High | 2026-10-13 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception. |
| CVE-2026-95695 | Critical | 2026-10-13 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization. |
| CVE-2026-93909 | Critical | 2026-10-13 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled. |
| CVE-2026-93905 | High | 2026-10-13 | Protected by Waratek | No public exploit | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances. |
| CVE-2026-93895 | Critical | 2026-10-13 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods. |
| CVE-2026-11538 | Medium | 2026-09-18 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies. |
| CVE-2026-10841 | Medium | 2026-09-18 | No exploit published | No public exploit | IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling. |
| CVE-2026-9667 | Medium | 2026-09-10 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints. |
| CVE-2026-9338 | Medium | 2026-09-10 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to trigger excessive resource consumption, potentially leading to reduced availability of the affected service. |
| CVE-2026-9336 | High | 2026-09-10 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted HTTP request to an administrative endpoint. A remote attacker could exploit this vulnerability to cause the server to exhaust filesystem space. |
| CVE-2026-9327 | High | 2026-09-10 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service. |
| CVE-2026-9176 | High | 2026-09-10 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources. |
| CVE-2026-14525 | Critical | 2026-08-13 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled. |
| CVE-2026-10571 | Medium | 2026-08-13 | Protected by Waratek | No public exploit | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled. |
| CVE-2026-18499 | High | 2026-08-12 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives. |
| CVE-2026-8400 | Critical | 2026-08-05 | Protected by Waratek | No public exploit | IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes. |
| CVE-2026-9322 | High | 2026-07-30 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request. |
| CVE-2026-14980 | High | 2026-07-30 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled. |
| CVE-2026-11897 | High | 2026-07-30 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. |
| CVE-2026-11707 | Critical | 2026-07-30 | No exploit published | No public exploit | IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page. |
| CVE-2026-11536 | High | 2026-07-30 | Protected by Waratek | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector. |
| CVE-2026-11383 | Medium | 2026-07-30 | No exploit published | No public exploit | IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console. |
| CVE-2026-10842 | High | 2026-07-30 | No exploit published | No public exploit | IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints. |
| CVE-2026-2482 | High | 2026-07-29 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. |
| CVE-2026-14529 | Critical | 2026-07-29 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled. |
| CVE-2026-16192 | High | 2026-07-28 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled. |
| CVE-2026-16184 | Critical | 2026-07-28 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request. |
| CVE-2026-15328 | High | 2026-07-28 | No exploit published | No public exploit | IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling. |
| CVE-2026-15325 | High | 2026-07-28 | No exploit published | No public exploit | IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE requests. |
| CVE-2026-15280 | High | 2026-07-28 | Protected by Waratek | No public exploit | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism. |
| CVE-2026-15064 | High | 2026-07-28 | No exploit published | No public exploit | IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens. |
| CVE-2026-15057 | High | 2026-07-28 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation. |
| CVE-2026-14981 | High | 2026-07-28 | No exploit published | No public exploit | IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits. |
| CVE-2026-14976 | Critical | 2026-07-28 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled. |
| CVE-2026-14974 | Critical | 2026-07-28 | Protected by Waratek | No public exploit | IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data. |
| CVE-2026-14528 | High | 2026-07-28 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information. |
| CVE-2026-14515 | Medium | 2026-07-28 | No exploit published | No public exploit | IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack. |
| CVE-2026-14512 | Critical | 2026-07-28 | Protected by Waratek | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code. |
| CVE-2026-14446 | Critical | 2026-07-28 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console. |
| CVE-2026-11806 | High | 2026-06-30 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled. |
| CVE-2026-11714 | Critical | 2026-06-30 | No exploit published | No public exploit | IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled. |
| CVE-2026-11712 | Critical | 2026-06-30 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system. |
| CVE-2026-11708 | Critical | 2026-06-30 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system. |
| CVE-2026-11595 | High | 2026-06-30 | Protected by Waratek | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information from the administrative console's integrated help system. |
| CVE-2026-11594 | High | 2026-06-30 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console. |
| CVE-2026-11546 | Critical | 2026-06-30 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled. |
| CVE-2026-11541 | Critical | 2026-06-30 | No exploit published | No public exploit | IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability. |
| CVE-2026-9320 | High | 2026-06-22 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. |
| CVE-2026-9071 | High | 2026-06-22 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. |
| CVE-2026-9006 | Critical | 2026-06-22 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to send unauthorized requests from the system, resulting in a security bypass or information disclosure. |
| CVE-2026-8646 | Critical | 2026-06-22 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling. A remote attacker could smuggle a specially crafted request to the application server thereby allowing the attacker to bypass security controls, spoof identity, escalate privilege, and expose sensitive information. |
| CVE-2026-10845 | High | 2026-06-22 | No exploit published | No public exploit | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications. |
| CVE-2026-9330 | High | 2026-06-01 | Protected by Waratek | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deserialization using the SAML Web Single Sign-On component. This could result in remote code execution via a crafted HTTP request when combined with a suitable gadget chain. |
| CVE-2026-9319 | Critical | 2026-06-01 | Protected by Waratek | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security. |
| CVE-2026-9311 | Critical | 2026-06-01 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to remote code execution caused by the bypass of security controls. |
| CVE-2026-8644 | Critical | 2026-06-01 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to identity spoofing. |
| CVE-2026-5516 | Medium | 2026-05-27 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 22.0.0.11 through 26.0.0.5 IBM WebSphere Application Server Liberty could allow a remote attacker to bypass security under limited conditions by exploiting a specific timing window. |
| CVE-2026-4410 | High | 2026-05-27 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. |
| CVE-2026-8633 | Critical | 2026-05-26 | No exploit published | No public exploit | IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to remote code execution in the Web Server Plug-ins, through a specially crafted request. |
| CVE-2026-8620 | High | 2026-05-26 | No exploit published | No public exploit | IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to HTTP request smuggling in the Web Server Plug-ins through a specially crafted request. |
| CVE-2026-3621 | High | 2026-04-23 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.4 IBM WebSphere Application Server Liberty is vulnerable to identity spoofing under limited conditions when an application is deployed without authentication and authorization configured. |
| CVE-2026-1561 | Medium | 2026-03-25 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is vulnerable to server-side request forgery (SSRF). This may allow remote attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. |
| CVE-2025-14917 | Critical | 2026-03-25 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings. |
| CVE-2025-14915 | High | 2026-03-25 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is affected by privilege escalation. A privileged user could gain additional access to the application server. |
| CVE-2025-14923 | Critical | 2026-03-03 | No exploit published | No public exploit | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.2 IBM WebSphere Application Server Liberty could provide weaker than expected security when using the Security Utility when administering security settings. |
| CVE-2025-13333 | Medium | 2026-02-17 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0, and 8.5 could provide weaker than expected security during system administration of security settings. |
| CVE-2025-14914 | High | 2026-02-02 | Protected by Waratek | No public exploit | IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive containing path traversal sequences resulting in an overwrite of files leading to arbitrary code execution. |
| CVE-2025-12635 | Medium | 2025-12-08 | No exploit published | No public exploit | IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to improper validation of user-supplied input. An attacker could exploit this vulnerability by using a specially crafted URL to redirect the user to a malicious site. |
| CVE-2025-36099 | Medium | 2025-09-29 | No exploit published | No public exploit | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request. A privileged user could exploit this vulnerability to cause the server to consume memory resources. |
| CVE-2025-36047 | High | 2025-08-14 | No exploit published | No public exploit | IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. |
| CVE-2025-33142 | High | 2025-08-14 | No exploit published | No public exploit | IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for TLS connections. |
| CVE-2025-36124 | High | 2025-08-12 | No exploit published | No public exploit | IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a failure to honor JMS messaging configuration |
| CVE-2025-36000 | Medium | 2025-08-12 | No exploit published | No public exploit | IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. |
| CVE-2024-56339 | High | 2025-08-07 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker to bypass security restrictions caused by a failure to honor security configuration. |
| CVE-2025-36097 | High | 2025-07-16 | No exploit published | No public exploit | IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 are vulnerable to a denial of service, caused by a stack-based overflow. An attacker can send a specially crafted request that cause the server to consume excessive memory resources. |
| CVE-2025-36038 | Critical | 2025-06-25 | Protected by Waratek | No public exploit | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects. |
| CVE-2025-33104 | High | 2025-05-14 | No exploit published | No public exploit | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. |
| CVE-2025-27907 | Medium | 2025-04-22 | No exploit published | No public exploit | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. |
| CVE-2024-45087 | Medium | 2024-11-11 | No exploit published | No public exploit | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. |
| CVE-2024-45086 | Medium | 2024-11-04 | Protected by Waratek | No public exploit | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources. |
| CVE-2024-45072 | Medium | 2024-10-16 | Protected by Waratek | No public exploit | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources. |
| CVE-2024-45071 | Medium | 2024-10-16 | No exploit published | No public exploit | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. |
| CVE-2024-45085 | High | 2024-10-15 | No exploit published | No public exploit | IBM WebSphere Application Server 8.5 is vulnerable to a denial of service, under certain configurations, caused by an unexpected specially crafted request. A remote attacker could exploit this vulnerability to cause an error resulting in a denial of service. |
| CVE-2024-45073 | Medium | 2024-09-30 | No exploit published | No public exploit | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. |
| CVE-2023-50315 | Medium | 2024-08-14 | No exploit published | No public exploit | IBM WebSphere Application Server 8.5 and 9.0 could allow an attacker with access to the network to conduct spoofing attacks. An attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information. IBM X-Force ID: 274714. |
| CVE-2023-50314 | High | 2024-08-14 | No exploit published | No public exploit | IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.8 could allow an attacker with access to the network to conduct spoofing attacks. An attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information. IBM X-Force ID: 274713. |
| CVE-2024-35154 | High | 2024-07-09 | No exploit published | No public exploit | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code. Using specially crafted input, the attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 292641. |
| CVE-2024-35153 | Medium | 2024-06-27 | No exploit published | No public exploit | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 292640. |
| CVE-2024-37532 | High | 2024-06-20 | No exploit published | No public exploit | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to identity spoofing by an authenticated user due to improper signature validation. IBM X-Force ID: 294721. |
| CVE-2024-25026 | High | 2024-04-25 | No exploit published | No public exploit | IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 are vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 281516. |
| CVE-2024-22354 | High | 2024-04-17 | Protected by Waratek | No public exploit | IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.5 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information, consume memory resources, or to conduct a server-side request forgery attack. IBM X-Force ID: 280401. |
| CVE-2024-22329 | Medium | 2024-04-17 | No exploit published | No public exploit | IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.3 are vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker could exploit this vulnerability to conduct the SSRF attack. X-Force ID: 279951. |
| CVE-2024-27268 | High | 2024-04-04 | No exploit published | No public exploit | IBM WebSphere Application Server Liberty 18.0.0.2 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 284574. |
| CVE-2023-50313 | Medium | 2024-04-02 | No exploit published | No public exploit | IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274812. |
| CVE-2024-22353 | High | 2024-03-31 | No exploit published | No public exploit | IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 280400. |
| CVE-2024-27270 | Medium | 2024-03-27 | No exploit published | No public exploit | IBM WebSphere Application Server Liberty 23.0.0.3 through 24.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in a specially crafted URI. IBM X-Force ID: 284576. |
| CVE-2023-50312 | Medium | 2024-03-01 | No exploit published | No public exploit | IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.2 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274711. |
| CVE-2023-46158 | Critical | 2023-10-25 | No exploit published | No public exploit | IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security due to improper resource expiration handling. IBM X-Force ID: 268775. |
| CVE-2023-38737 | High | 2023-08-16 | No exploit published | No public exploit | IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 262567. |
| CVE-2023-35890 | Medium | 2023-07-07 | No exploit published | No public exploit | IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security, caused by the improper encoding in a local configuration file. IBM X-Force ID: 258637. |