CVE-2026-95695

IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10 are vulnerable to a security bypass due to incorrect authorization (CWE-863). This issue specifically affects environments with the grpc-1.0 feature enabled, potentially allowing a remote attacker to bypass security r...

CVE-2026-95695 IBM WebSphere Application Server Liberty Incorrect Authorization

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization...

CVE-2026-95696

IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10 are vulnerable to a denial of service (DoS) attack. The root cause is an uncaught exception triggered by uncontrolled resource consumption (CWE-400) when the grpc-1.0 feature is enabled. A remote attacker can exploit ...

CVE-2026-95696 IBM WebSphere Application Server Liberty Denial of Service

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception...

CVE-2026-101294

IBM WebSphere Application Server and WebSphere Application Server Liberty are impacted by a missing cryptographic step vulnerability (CWE-325 ). The root cause is the improper verification of cryptographic signatures , which could allow a remote attacker to bypass signature verification. Affected...

CVE-2026-101294 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature...

CVE-2026-101294 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a missing cryptographic step

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass cryptographic signature verification due to improper verification of cryptographic signature...

CVE-2026-105442

IBM WebSphere Application Server and WebSphere Application Server Liberty are impacted by a deserialization of untrusted data vulnerability (CWE-502) within the messaging service. A remote attacker can exploit this flaw to cause a denial of service . Affected products include WebSphere Applicatio...

CVE-2026-105442 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a deserialization of untrusted data

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause a denial of service caused by an insecure deserialization in the messaging service...

CVE-2026-105443

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 are affected by an improper access control vulnerability (CWE-284) characterized by insufficient isolation between servers sharing an installation. This issue specifically impacts instances with the restConnector-1.0 or ...

CVE-2026-105443 IBM WebSphere Application Server Liberty is affected by an improper access control

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install...

CVE-2026-11713

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.9 are affected by a privilege escalation vulnerability (CVE-2026-11713 ) when the restConnector-2.0 feature is enabled. The root cause is identified as Incorrect Authorization (CWE-863 ), which could allow an attacker to ga...

CVE-2026-11713 IBM WebSphere Application Server Liberty Incorrect Authorization

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabled...

CVE-2026-14532

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9 are vulnerable to an Integer Overflow (CWE-190) that allows an attacker with Reader-role privileges to obtain version information, which can trigger an uncaught exception . This issue also affects IBM Tivoli Application...

CVE-2026-14532 IBM WebSphere Application Server Liberty Integer Overflow

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception...

CVE-2026-14909

IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.9) is vulnerable to an information disclosure vulnerability (CWE-209). When the restConnector-2.0 feature is enabled, an authenticated attacker can obtain sensitive information through the generation of error messages cont...

CVE-2026-14909 IBM WebSphere Application Server Liberty Information Disclosure

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled...

CVE-2026-77816 IBM WebSphere Application Server Liberty Improper Certificate Validation

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information...

CVE-2026-77816

The IBM WebSphere Application Server - Liberty administrative client (versions 17.0.0.3 through 26.0.0.9 ) is vulnerable to a man-in-the-middle attack due to Improper Certificate Validation (CWE-295). An attacker could exploit this flaw to obtain sensitive information. This vulnerability also aff...

CVE-2026-79715

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.9 are vulnerable to a path traversal vulnerability (CWE-22 ). A local attacker can use a specially crafted application archive to traverse directories and write files outside the intended directory. This issue also affect...