5204 matches found
CVE-2026-16185
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication on an admin console servlet...
CVE-2026-16187
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication and obtain sensitive information by sending a crafted unauthenticated request...
CVE-2026-16188
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log...
CVE-2026-15396
CVE-2026-15396 affects IBM WebSphere Application Server (traditional 8.5 and 9.0) and IBM WebSphere Application Server Liberty (versions 17.0.0.3–26.0.0.8). The root cause is improper parsing of the HTTP transfer-encoding request header (CWE-444), enabling HTTP request smuggling . An unauthentica...
CVE-2026-15412
CVE-2026-15412 is an open redirect vulnerability (CWE-601) affecting IBM WebSphere Application Server versions 9.0 and 8.5, as well as WebSphere Application Server Liberty . A remote attacker with no privileges can persuade a victim to visit a crafted URL that redirects them to a malicious site w...
EUVD-2026-78060
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could...
CVE-2026-15634
CVE-2026-15634 is an HTTP request smuggling vulnerability (CWE-444) in IBM WebSphere Application Server 9.0, 8.5, and Liberty (17.0.0.3–26.0.0.8), caused by improper parsing of the HTTP transfer-encoding request header . A remote, unauthenticated attacker can send a specially crafted header to po...
EUVD-2026-78056
IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests...
CVE-2026-15887
IBM WebSphere Application Server versions 9.0.0.0 through 9.0.5.28 and 8.5.0.0 through 8.5.5.30 are affected by a blind server-side request forgery (SSRF) vulnerability (CWE-918) triggered when processing SOAP requests . An attacker with low privileges can exploit this over the network with low c...
CVE-2026-16186
IBM WebSphere Application Server versions prior to 9.0.5.29 and 8.5.5.31 are affected by a reflected cross-site scripting (XSS) vulnerability. The flaw requires user interaction and is exploitable over the network without authentication, but impact is limited to low confidentiality and integrity ...
EUVD-2026-78053
IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability...
CVE-2026-16185 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication on an admin console servlet...
EUVD-2026-77811
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication on an admin console servlet...
CVE-2026-16185
IBM WebSphere Application Server versions 9.0 and 8.5 are affected by an authentication bypass on an admin console servlet, classified as CWE-862 (Missing Authorization) . The vulnerability is scored CVSS 6.4 (MEDIUM) with an adjacent-network attack vector, high complexity, no required privileges...
CVE-2026-16187
IBM WebSphere Application Server versions 9.0 (prior to 9.0.5.29) and 8.5 (prior to 8.5.5.31) are vulnerable to an authentication bypass that allows a remote attacker to send a crafted unauthenticated request and obtain sensitive information . The CVSS 3.1 score is 6.5 (MEDIUM) with an Adjacent N...
EUVD-2026-77806
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication and obtain sensitive information by sending a crafted unauthenticated request...
CVE-2026-16187 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication and obtain sensitive information by sending a crafted unauthenticated request...
EUVD-2026-77803
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log...
CVE-2026-16188
IBM WebSphere Application Server 9.0 and 8.5 are vulnerable to a log injection flaw that allows a remote, unauthenticated attacker to forge entries in the server's administrative log . The CVELIST record specifies that versions prior to 9.0.5.29 and prior to 8.5.5.31 are affected, implying those ...