CVE-2026-79715 IBM WebSphere Application Server Liberty Path Traversal

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive to write files outside the intended directory...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by an authentication bypass (CVE-2026-93909)

Summary IBM WebSphere Application Server Liberty is affected by an authentication bypass with the samlWeb-2.0 enabled. Vulnerability Details CVEID:CVE-2026-93909 DESCRIPTION: IBM WebSphere Application Server Liberty is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature ...

Security Bulletin: IBM WebSphere Application Server is affected by an improper authentication (CVE-2026-95680)

Summary IBM WebSphere Application Server is affected by an improper authentication. Vulnerability Details CVEID:CVE-2026-95680 DESCRIPTION: IBM WebSphere Application Server could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data (CVE-2026-93905)

Summary IBM WebSphere Application Server Liberty is affected by a deserialization of untrusted data with the batchManagement-1.0 enabled. Vulnerability Details CVEID:CVE-2026-93905 DESCRIPTION: IBM WebSphere Application Server Liberty could allow an unauthenticated remote attacker to corrupt the...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by multiple vulnerabilities (CVE-2026-93895, CVE-2026-95695, CVE-2026-95696)

Summary IBM WebSphere Application Server Liberty is affected by multiple vulnerabilities with grpc-1.0 enabled. Vulnerability Details CVEID:CVE-2026-93895 DESCRIPTION: WebSphere Application Server Liberty could allow an unauthenticated remote attacker to bypass access controls configured on gRPC...

CVE-2026-93907

IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler...

CVE-2026-95680

IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell...

CVE-2026-93907

IBM WebSphere Application Server versions 8.5 and 9.0 are affected by a vulnerability that allows a remote attacker to bypass authentication. The root cause is a flaw in the CSIv2 inbound propagation handler (CWE-287: Improper Authentication). Successful exploitation can lead to high impacts on c...

CVE-2026-93907 IBM WebSphere Application Server is affected by a bypass authentication vulnerability

IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler...

CVE-2026-95680

IBM WebSphere Application Server versions 8.5 and 9.0 are affected by an improper authentication vulnerability (CWE-287 ). This flaw could allow an authenticated attacker to bypass authorization, potentially leading to administrative impersonation across the cell. To remediate this, IBM recommend...

CVE-2026-95680 IBM WebSphere Application Server is affected by an authorization bypass

IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell...

CVE-2026-103499 IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 Liberty could allow a remote unauthenticated attacker to cause a denial of service due to uncontrolled resource consumption...

CVE-2026-103499

IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption (CWE-400). This flaw allows a remote, unauthenticated attacker to exhaust system resources. Affected Products and Versions: WebSphe...

Security Bulletin: IBM WebSphere Application Server is affected by a bypass authentication vulnerability (CVE-2026-93907)

Summary IBM WebSphere Application Server is affected by a bypass authentication vulnerability. Vulnerability Details CVEID:CVE-2026-93907 DESCRIPTION: IBM WebSphere Application Server could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service (CVE-2026-103499)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service vulnerability. Vulnerability Details CVEID:CVE-2026-103499 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote unauthenticated attacker to cause a denial of...

CVE-2026-89108

SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the...

CVE-2026-76976

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious...

EUVD-2026-98191

SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the...

CVE-2026-89108

SAP Manufacturing Integration and Intelligence (Configuration Service) contains a missing authorization check (CWE-862) within certain administrative functionalities. An attacker possessing MII administrator privileges can submit a specially crafted request to provision an account with elevated p...

CVE-2026-89108 Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)

SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the...