Advisories · Technology

IBM WebSphere Application Server.

Every CVE that names IBM WebSphere Application Server among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-9319 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

IBM WebSphere Application Server is affected by a remote code execution vulnerability
- IBM WebSphere Application Server
- Insecure deserialization
Not analysed yet 1 Jun 2026
CVE-2026-9311 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

IBM WebSphere Application Server is affected by remote code execution
- IBM WebSphere Application Server
- Code injection
Not analysed yet 1 Jun 2026
CVE-2026-8644 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

IBM WebSphere Application Server is affected by an identity spoofing vulnerability
- IBM WebSphere Application Server
- Authentication bypass
Not analysed yet 1 Jun 2026
CVE-2026-4410 CVE record

CVSS 4.8 Medium

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service
- IBM WebSphere Application Server - Liberty
- IBM WebSphere Application Server
- Denial of service
Not analysed yet 27 May 2026
CVE-2025-13333 CVE record

CVSS 4.4 Medium

IBM WebSphere Application Server could provide weaker than expected security
- IBM WebSphere Application Server
- CWE-358
Not analysed yet 17 Feb 2026
CVE-2025-12635 CVE record

CVSS 5.4 Medium

IBM WebSphere Application Server and WebSphere Application Server Liberty Cross-Site Scripting
- IBM WebSphere Application Server
- IBM WebSphere Application Server Liberty
- Cross-site scripting (XSS)
Not analysed yet 8 Dec 2025
CVE-2025-36099 CVE record

CVSS 4.9 Medium

IBM WebSphere Application Server denial of service
- IBM WebSphere Application Server
- Denial of service
Not analysed yet 29 Sept 2025
CVE-2025-33142 CVE record

CVSS 5.3 Medium

IBM WebSphere Application Server information disclosure
- IBM WebSphere Application Server
- Weak cryptography or TLS
Not analysed yet 14 Aug 2025
CVE-2024-56339 CVE record

CVSS 3.7 Low

IBM WebSphere Application Server information disclosure
- IBM WebSphere Application Server
- IBM WebSphere Application Server Liberty
- CWE-650
Not analysed yet 7 Aug 2025
CVE-2025-36097 CVE record

CVSS 7.5 High

IBM WebSphere Application Server denial of service
- IBM WebSphere Application Server
- IBM WebSphere Application Server Liberty
- Memory corruption
Not analysed yet 16 Jul 2025
CVE-2025-36038 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

IBM WebSphere Application Server code execution
- IBM WebSphere Application Server
- Insecure deserialization
Not analysed yet 25 Jun 2025
CVE-2025-33104 CVE record

CVSS 4.4 Medium

IBM WebSphere Application Server cross
- IBM WebSphere Application Server
- Cross-site scripting (XSS)
Not analysed yet 14 May 2025
CVE-2025-27907 CVE record

CVSS 4.1 Medium

IBM WebSphere Application Server server-side request forgery
- IBM WebSphere Application Server
- Server-side request forgery (SSRF)
Not analysed yet 22 Apr 2025
CVE-2024-45087 CVE record

CVSS 4.8 Medium

IBM WebSphere Application Server cross-site scripting
- IBM WebSphere Application Server
- Cross-site scripting (XSS)
Not analysed yet 11 Nov 2024
CVE-2024-45086 CVE record

CVSS 5.5 Medium

IBM WebSphere Application Server XML external entity injection
- IBM WebSphere Application Server
- XML external entities (XXE)
Not analysed yet 4 Nov 2024
CVE-2024-45071 CVE record

CVSS 5.5 Medium

IBM WebSphere Application Server cross-site scripting
- IBM WebSphere Application Server
- Cross-site scripting (XSS)
Not analysed yet 16 Oct 2024
CVE-2024-45072 CVE record

CVSS 5.5 Medium

IBM WebSphere Application Server XML external entity injection
- IBM WebSphere Application Server
- XML external entities (XXE)
Not analysed yet 16 Oct 2024
CVE-2024-45085 CVE record

CVSS 5.9 Medium

IBM WebSphere Application Server denial of service
- IBM WebSphere Application Server
- CWE-754
Not analysed yet 15 Oct 2024
CVE-2024-45073 CVE record

CVSS 4.8 Medium

IBM WebSphere Application Server cross-site scripting
- IBM WebSphere Application Server
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2024
CVE-2023-50315 CVE record

CVSS 5.3 Medium

IBM WebSphere Application Server information disclosure
- IBM WebSphere Application Server
- Weak cryptography or TLS
Not analysed yet 14 Aug 2024
CVE-2024-35154 CVE record

CVSS 7.2 High

IBM WebSphere Application Server code execution
- IBM WebSphere Application Server
- Privilege escalation
Not analysed yet 9 Jul 2024
CVE-2024-35153 CVE record

CVSS 4.8 Medium

IBM WebSphere Application Server cross-site scripting
- IBM WebSphere Application Server
- Cross-site scripting (XSS)
Not analysed yet 27 Jun 2024
CVE-2024-37532 CVE record

CVSS 8.8 High

IBM WebSphere Application Server identity spoofing
- IBM WebSphere Application Server
- Weak cryptography or TLS
Not analysed yet 20 Jun 2024
CVE-2024-25026 CVE record

CVSS 5.9 Medium

IBM WebSphere Application Server denial of service
- IBM WebSphere Application Server
- IBM WebSphere Application Server Liberty
- Denial of service
Not analysed yet 25 Apr 2024
CVE-2024-22329 CVE record

CVSS 4.3 Medium

IBM WebSphere Application Server server-side request forgery
- IBM WebSphere Application Server
- IBM WebSphere Application Server Liberty
- Server-side request forgery (SSRF)
Not analysed yet 17 Apr 2024
CVE-2024-22354 CVE record

CVSS 7.0 High

IBM WebSphere Application Server XML external entity injection
- IBM WebSphere Application Server
- IBM WebSphere Application Server Liberty
- XML external entities (XXE)
Not analysed yet 17 Apr 2024
CVE-2023-50313 CVE record

CVSS 5.3 Medium

IBM WebSphere Application Server information disclosure
- IBM WebSphere Application Server
- Weak cryptography or TLS
Not analysed yet 2 Apr 2024
CVE-2023-35890 CVE record

CVSS 5.1 Medium

IBM WebSphere Application Server information disclosure
- IBM WebSphere Application Server
- Weak cryptography or TLS
Not analysed yet 7 Jul 2023
CVE-2023-27554 CVE record

CVSS 6.3 Medium

IBM WebSphere Application Server XML external entity injection
- IBM WebSphere Application Server
- XML external entities (XXE)
Not analysed yet 11 May 2023
CVE-2022-39161 CVE record

CVSS 4.8 Medium

IBM WebSphere Application Server information disclosure
- IBM WebSphere Application Server
- Weak cryptography or TLS
Not analysed yet 3 May 2023
CVE-2023-24966 CVE record

CVSS 6.1 Medium

IBM WebSphere Application Server cross-site scripting
- IBM WebSphere Application Server
- Cross-site scripting (XSS)
Not analysed yet 27 Apr 2023
CVE-2023-26283 CVE record

CVSS 5.4 Medium

IBM WebSphere Application Server cross-site scripting
- IBM WebSphere Application Server
- Cross-site scripting (XSS)
Not analysed yet 22 Mar 2023
CVE-2023-23477 CVE record

CVSS 8.1 High

IBM WebSphere Application Server code execution
- IBM WebSphere Application Server
- Code injection
Not analysed yet 3 Feb 2023
CVE-2022-43917 CVE record

CVSS 5.9 Medium

IBM WebSphere Application Server information disclosure
- IBM WebSphere Application Server
- Weak cryptography or TLS
Not analysed yet 25 Jan 2023
CVE-2022-40750 CVE record

CVSS 5.4 Medium

IBM WebSphere Application Server cross-site scripting
- IBM WebSphere Application Server
- Cross-site scripting (XSS)
Not analysed yet 11 Nov 2022
CVE-2022-38712 CVE record

CVSS 5.9 Medium

Authentication bypass by spoofing in IBM WebSphere Application Server
- IBM WebSphere Application Server
- Authentication bypass
Not analysed yet 3 Nov 2022
CVE-2022-35282 CVE record

CVSS 4.3 Medium

Server-side request forgery in IBM WebSphere Application Server
- IBM WebSphere Application Server
- Server-side request forgery (SSRF)
Not analysed yet 28 Sept 2022
CVE-2022-34336 CVE record

CVSS 5.4 Medium

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting.
- IBM WebSphere Application Server
Not analysed yet 13 Sept 2022
CVE-2022-34165 CVE record

CVSS 5.4 Medium

IBM WebSphere Application Server: IBM WebSphere Application Server 7.0, 8.0, 8.5…
- IBM WebSphere Application Server
- IBM WebSphere Application Server Liberty
Not analysed yet 9 Sept 2022
CVE-2022-22477 CVE record

CVSS 6.1 Medium

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting.
- IBM WebSphere Application Server
Not analysed yet 14 Jul 2022
CVE-2022-22473 CVE record

CVSS 3.7 Low

IBM WebSphere Application Server: IBM WebSphere Application Server 7.0, 8.0, 8.5…
- IBM WebSphere Application Server
Not analysed yet 14 Jul 2022
CVE-2022-22365 CVE record

CVSS 5.6 Medium

IBM WebSphere Application Server: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0…
- IBM WebSphere Application Server
Not analysed yet 20 May 2022
CVE-2021-39038 CVE record

CVSS 4.4 Medium

IBM WebSphere Application Server Liberty: IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty…
- IBM WebSphere Application Server Liberty
- IBM WebSphere Application Server
Not analysed yet 24 Feb 2022
CVE-2021-38951 CVE record

CVSS 7.5 High

IBM WebSphere Application Server: IBM WebSphere Application Server 7.0, 8.0, 8.5…
- IBM WebSphere Application Server
Not analysed yet 9 Dec 2021
CVE-2021-29842 CVE record

CVSS 3.7 Low

IBM WebSphere Application Server: IBM WebSphere Application Server 7.0, 8.0, 8.5…
- IBM WebSphere Application Server
- IBM WebSphere Application Server Liberty
Not analysed yet 16 Sept 2021
CVE-2021-29736 CVE record

CVSS 5.0 Medium

IBM WebSphere Application Server: IBM WebSphere Application Server 7.0, 8.0, 8.5…
- IBM WebSphere Application Server
Not analysed yet 30 Jul 2021
CVE-2021-29754 CVE record

CVSS 4.2 Medium

IBM WebSphere Application Server: IBM WebSphere Application Server 7.0, 8.0, 8.5…
- IBM WebSphere Application Server
Not analysed yet 11 Jun 2021
CVE-2021-20492 CVE record

CVSS 6.5 Medium

IBM WebSphere Application Server: IBM WebSphere Application Server 8.0, 8.5, 9.0…
- IBM WebSphere Application Server
Not analysed yet 26 May 2021
CVE-2021-20454 CVE record

CVSS 8.2 High

IBM WebSphere Application Server: IBM WebSphere Application Server 7.0, 8.0, 8.5…
- IBM WebSphere Application Server
Not analysed yet 21 Apr 2021
CVE-2021-20453 CVE record

CVSS 8.2 High

IBM WebSphere Application Server: IBM WebSphere Application Server 8.0, 8.5…
- IBM WebSphere Application Server
Not analysed yet 20 Apr 2021
CVE-2021-20480 CVE record

CVSS 4.3 Medium

IBM WebSphere Application Server: IBM WebSphere Application Server 7.0, 8.0…
- IBM WebSphere Application Server
Not analysed yet 8 Apr 2021
CVE-2020-5016 CVE record

CVSS 5.3 Medium

IBM WebSphere Application Server: IBM WebSphere Application Server 7.0, 8.0, 8.5…
- IBM WebSphere Application Server
Not analysed yet 10 Mar 2021
CVE-2021-20354 CVE record

CVSS 5.9 Medium

IBM WebSphere Application Server: IBM WebSphere Application Server 8.0, 8.5…
- IBM WebSphere Application Server
Not analysed yet 18 Feb 2021
CVE-2021-20353 CVE record

CVSS 8.2 High

IBM WebSphere Application Server: IBM WebSphere Application Server 7.0, 8.0, 8.5…
- IBM WebSphere Application Server
Not analysed yet 10 Feb 2021
CVE-2020-4949 CVE record

CVSS 8.2 High

IBM WebSphere Application Server: IBM WebSphere Application Server 7.0, 8.0, 8.5…
- IBM WebSphere Application Server
Not analysed yet 26 Jan 2021
CVE-2020-4782 CVE record

CVSS 6.5 Medium

IBM WebSphere Application Server: IBM WebSphere Application Server 7.0, 8.0, 8.5…
- IBM WebSphere Application Server
Not analysed yet 28 Oct 2020
CVE-2020-4576 CVE record

CVSS 5.3 Medium

IBM WebSphere Application Server: IBM WebSphere Application Server 7.5, 8.0, 8.5…
- IBM WebSphere Application Server
Not analysed yet 1 Oct 2020
CVE-2020-4629 CVE record

CVSS 2.9 Low

IBM WebSphere Application Server: IBM WebSphere Application Server 7.0, 8.0, 8.5…
- IBM WebSphere Application Server
Not analysed yet 30 Sept 2020
CVE-2020-4643 CVE record

CVSS 7.5 High

IBM WebSphere Application Server: IBM WebSphere Application Server 7.0, 8.0, 8.5…
- IBM WebSphere Application Server
Not analysed yet 21 Sept 2020
CVE-2020-4578 CVE record

CVSS 5.4 Medium

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting.
- IBM WebSphere Application Server
Not analysed yet 10 Sept 2020