IBM WebSphere Application Server Liberty
30 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-1561 | 17.0.0.3 – 26.0.0.3 | IBM WebSphere Application Server Liberty Server-Side Request Forgery | MEDIUM 5.4 | 0.3 % | ||
| CVE-2025-14914 | 17.0.0.3 – 26.0.0.1 | IBM WebSphere Application Server Liberty Path Traversal | HIGH 7.6 | 0.5 % | ||
| CVE-2025-12635 | 17.0.0.3 – 25.0.0.12 | IBM WebSphere Application Server and WebSphere Application Server Liberty Cross-Site Scripting | MEDIUM 5.4 | 0.2 % | ||
| CVE-2025-36047 | 18.0.0.2 – 25.0.0.8 | IBM WebSphere Application Server Liberty denial of service | HIGH 7.5 | 0.5 % | ||
| CVE-2025-36000 | 17.0.0.3 – 25.0.0.8 | IBM WebSphere Application Server Liberty cross-site scripting | MEDIUM 4.8 | 0.2 % | ||
| CVE-2025-36124 | 17.0.0.3 – 25.0.0.8 | IBM WebSphere Application Server Liberty bypass security | HIGH 7.5 | 0.4 % | ||
| CVE-2024-56339 | 17.0.0.3 – 25.0.0.7 | IBM WebSphere Application Server information disclosure | HIGH 7.5 | 0.5 % | ||
| CVE-2025-36097 | 17.0.0.3 – 25.0.0.7 | IBM WebSphere Application Server denial of service | HIGH 7.5 | 0.5 % | ||
| CVE-2024-25026 | 17.0.0.3 – 24.0.0.4 | IBM WebSphere Application Server denial of service | HIGH 7.5 | 0.8 % | ||
| CVE-2024-22329 | 17.0.0.3 – 24.0.0.3 | IBM WebSphere Application Server server-side request forgery | MEDIUM 4.3 | 0.3 % | ||
| CVE-2024-22354 | 17.0.0.3 – 24.0.0.5 ; cpe:2.3:a:ibm:websphere_application_server:17.0.0.3:*:*:*:liberty:*:*:* ; cpe:2.3:a:ibm:websphere_application_server:24.0.0.5:*:*:*:liberty:*:*:* | IBM WebSphere Application Server XML external entity injection | HIGH 7.0 | 0.6 % | ||
| CVE-2024-27268 | 18.0.0.2 – 24.0.0.4 | IBM WebSphere Application Server Liberty denial of service | HIGH 7.5 | 1.3 % | ||
| CVE-2024-22353 | 17.0.0.3 – 24.0.0.4 | IBM WebSphere Application Server Liberty denial of service | HIGH 7.5 | 0.8 % | ||
| CVE-2024-27270 | 23.0.0.3 – 24.0.0.3 | IBM WebSphere Application Server Liberty cross-site scripting | MEDIUM 6.1 | 0.4 % | ||
| CVE-2023-50312 | 17.0.0.3 – 24.0.0.2 | IBM WebSphere Application Server Liberty information disclosure | MEDIUM 6.5 | 0.6 % | ||
| CVE-2023-46158 | 23.0.0.9, 23.0.0.10 | IBM WebSphere Application Server session fixation | CRITICAL 9.8 | 0.5 % | ||
| CVE-2023-38737 | 22.0.0.13 – 23.0.0.7 | IBM WebSphere Application Server Liberty denial of service | HIGH 7.5 | 1.0 % | ||
| CVE-2022-34165 | 17.0.0.3 ; 22.0.0.9 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.9 are vulnerabl | MEDIUM 5.4 | 0.6 % | ||
| CVE-2022-22476 | 17.0.0.3 ; 22.0.0.7 | IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty are vulnerable to identity spoofing by an authenticated | HIGH 8.8 | 0.7 % | ||
| CVE-2022-22475 | 17.0.0.3 ; 22.0.0.5 | IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are vulnerable to identity spoofing by an authenticated | MEDIUM 6.5 | 0.6 % | ||
| CVE-2022-22393 | 17.0.0.3 ; 22.0.0.5 | IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.5 , with the adminCenter-1.0 feature configured, could allow an authenticat | MEDIUM 6.5 | 0.7 % | ||
| CVE-2021-39038 | 17.0.0.3 ; 22.0.0.2 | IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow a remote attacker to | MEDIUM 5.4 | 0.6 % | ||
| CVE-2021-39031 | 17.0.0.3 ; 22.0.0.1 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to conduct an LDAP injectio | HIGH 8.8 | 2.0 % | ||
| CVE-2022-22310 | 21.0.0.10 ; 21.0.0.12 | IBM WebSphere Application Server Liberty 21.0.0.10 through 21.0.0.12 could provide weaker than expected security. A remote attacker could ex | MEDIUM 6.5 | 1.0 % | ||
| CVE-2021-29842 | 17.0.0.3 ; 21.0.0.9 | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames d | MEDIUM 5.3 | 1.3 % | ||
| CVE-2020-4590 | 17.0.0.3 ; 20.0.0.9 | IBM WebSphere Application Server Liberty 17.0.0.3 through 20.0.0.9 running oauth-2.0 or openidConnectServer-1.0 server features is vulnerabl | MEDIUM 6.5 | 1.2 % | ||
| CVE-2020-4421 | 20.0.0.4 ; 19.0.0.5 | IBM WebSphere Application Liberty 19.0.0.5 through 20.0.0.4 could allow an authenticated user using openidconnect to spoof another users ide | MEDIUM 5.4 | 0.6 % | ||
| CVE-2020-4329 | 17.0.0.3 ; 20.0.0.4 | IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 20.0.0.4 could allow a remote, authenticated attacker to ob | MEDIUM 4.3 | 1.1 % | ||
| CVE-2020-4304 | 17.0.0.3 ; 20.0.0.3 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users | MEDIUM 6.1 | 0.8 % | ||
| CVE-2020-4303 | 17.0.0.3 ; 20.0.0.3 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users | MEDIUM 6.1 | 0.8 % |