CVE-2026-16186: Improper Neutralization of Input During Web Page Generation

IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability...

CVE-2026-15887: Server-Side Request Forgery (SSRF)

IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests...

CVE-2026-15396: Inconsistent Interpretation of HTTP Requests

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could...

CVE-2026-16435: Trusting HTTP Permission Methods on the Server Side

IBM WebSphere Application Server 9.0, and 8.5 is affected by an authentication bypass vulnerability when using XD or Intelligent-Management features...

CVE-2026-16189: Improper Output Neutralization for Logs

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log...

PT-2026-91421

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log...

CVE-2026-16185: Missing Authorization

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication on an admin console servlet...

PT-2026-91451

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server version 9.0 IBM WebSphere Application Server version 8.5 Description Blind server-side request forgery occurs when processing SOAP requests. Server-side request forgery is a flaw that allows an attacker to indu...

PT-2026-91420

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log...

PT-2026-91422

IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization bypass vulnerability...

PT-2026-91453

IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability...

CVE-2026-16187: Missing Authorization

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication and obtain sensitive information by sending a crafted unauthenticated request...

CVE-2026-16190: Missing Authorization

IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization bypass vulnerability...

PT-2026-91426

IBM WebSphere Application Server 9.0, and 8.5 is affected by an authentication bypass vulnerability when using XD or Intelligent-Management features...

PT-2026-91450

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server 9.0 IBM WebSphere Application Server 8.5 IBM WebSphere Application Server - Liberty affected versions not specified Description Improper parsing of the HTTP transfer-encoding request header allows for HTTP...

PT-2026-91448

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could...

PT-2026-91419

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication and obtain sensitive information by sending a crafted unauthenticated request...

PT-2026-91418

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication on an admin console servlet...

CVE-2026-15412: URL Redirection to Untrusted Site

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability t...

CVE-2026-9176

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources...