CVE-2026-16192: Uncontrolled Recursion

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled...

CVE-2026-14446: Missing Authentication for Critical Function

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console...

CVE-2026-15280: Improper Limitation of a Pathname to a Restricted Directory

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism...

CVE-2026-15057: Out-of-bounds Write

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation...

CVE-2026-16184: Missing Authorization

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request...

CVE-2026-14515: Improper Neutralization of Input During Web Page Generation

IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack...

CVE-2026-14974: Deserialization of Untrusted Data

IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data...

CVE-2026-15325: Inconsistent Interpretation of HTTP Requests

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE requests...

PT-2026-65600

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server 8.5 IBM WebSphere Application Server 9.0 traditional Description A remote attacker could conduct a cross-site scripting attack, which involves injecting malicious scripts into benign and trusted websites...

PT-2026-65599

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server 9.0 IBM WebSphere Application Server 8.5 traditional Description Pre-authentication unsafe deserialization allows a remote attacker to bypass authentication or execute arbitrary code. Unsafe deserialization...

CVE-2026-14512: Deserialization of Untrusted Data

IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code...

CVE-2026-14976: Missing Authentication for Critical Function

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled...

CVE-2026-14528: Insertion of Sensitive Information into Log File

IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information...

PT-2026-65601

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server 9.0 IBM WebSphere Application Server 8.5 traditional Description A remote attacker could obtain sensitive information from the system. Recommendations At the moment, there is no information about a newer versio...

Security Bulletin: Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with TXSeries for Multiplatforms.

Summary Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with TXSeries for Multiplatforms CVE-2026-4410, CVE-2026-5516, CVE-2026-9071, CVE-2026-9320, CVE-2026-8646, CVE-2026-11541, CVE-2026-11806. IBM WebSphere Liberty has been updated within TXSeries for...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-11714 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3...

Security Bulletin: IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager is vulnerable to HTTP request smuggling and denial of service(CVE-2026-9071)

Summary A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager CVE-2026-9071 Vulnerability Details CVEID:CVE-2026-9071 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application...

IBM WebSphere Application Server Liberty 17.0.0.3 < 26.0.0.8 DoS (7280126)

The version of IBM WebSphere Application Server Liberty running on the remote host is affected by a DoS vulnerability as referenced in the 7280126 advisory. - IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server, which impacts IBM Tivoli Netcool Configuration Manager

Summary IBM WebSphere Application Server is a required product for IBM Tivoli Netcool Configuration Manager version 6.4.2. Multiple vulnerabilities were addressed in IBM WebSphere Application Server. Vulnerability Details CVEID:CVE-2026-50645 DESCRIPTION: There is no restriction on the amount of...

CVE-2026-9171: Uncontrolled Resource Consumption

IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources...