Veille CVE

Septembre 2026

27 CVE

Critique 0 Élevée 3 Moyenne 22 Faible 2 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « IBM WebSphere Application Server » ✕
  1. CVE-2026-11722 4.8 Moyenne

    IBM WebSphere Application Server · IBM WebSphere Application Server - Liberty

    IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability.

  2. CVE-2026-11711 6.5 Moyenne

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0 and 8.5 is affected by a deserialization vulnerability in the Name Service component.

  3. CVE-2026-11710 6.5 Moyenne

    IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers.

  4. CVE-2026-11549 6.5 Moyenne

    IBM WebSphere Application Server · IBM WebSphere Application Server - Liberty

    IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by a virtual host bypass vulnerability.

  5. CVE-2026-11548 4.8 Moyenne

    IBM WebSphere Application Server · IBM WebSphere Application Server - Liberty

    IBM WebSphere Application Server 8.5 and 9.0, and and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HTTP request smuggling vulnerability.

  6. CVE-2026-11545 3.7 Faible

    IBM WebSphere Application Server

    IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the administrative console due to missing authorization checks.

  7. CVE-2026-11540 5.3 Moyenne

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet.

  8. CVE-2026-11539 5.3 Moyenne

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0 and 8.5 is affected by an authentication bypass vulnerability in the SOAP/JMX connector.

  9. CVE-2026-11538 5.3 Moyenne

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies.

  10. CVE-2026-11537 4.3 Moyenne

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet.

  11. CVE-2026-10841 4.8 Moyenne

    IBM WebSphere Application Server · IBM WebSphere Application Server - Liberty

    IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling.

  12. CVE-2026-16435 5.9 Moyenne

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0, and 8.5 is affected by an authentication bypass vulnerability when using XD or Intelligent-Management features.

  13. CVE-2026-16190 3.1 Faible

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization bypass vulnerability.

  14. CVE-2026-16189 4.8 Moyenne

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log.

  15. CVE-2026-16188 5.3 Moyenne

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log.

  16. CVE-2026-16187 6.5 Moyenne

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication and obtain sensitive information by sending a crafted unauthenticated request.

  17. CVE-2026-16186 5.4 Moyenne

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability.

  18. CVE-2026-16185 6.4 Moyenne

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication on an admin console servlet.

  19. CVE-2026-15887 5.4 Moyenne

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests.

  20. CVE-2026-15634 6.5 Moyenne

    IBM WebSphere Application Server · IBM WebSphere Application Server - Liberty

    IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.

  21. CVE-2026-15412 6.5 Moyenne

    IBM WebSphere Application Server · IBM WebSphere Application Server - Liberty

    IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8  could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.

  22. CVE-2026-15396 6.5 Moyenne

    IBM WebSphere Application Server · IBM WebSphere Application Server - Liberty

    IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could exploit this vulnerability to poison the web cache, bypass web application firewall protection, and conduct XSS attacks.

  23. CVE-2026-9667 5.3 Moyenne

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints.

  24. CVE-2026-9327 8.1 Élevée

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service.

  25. CVE-2026-9176 7.1 Élevée

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources.

  26. CVE-2026-9338 5.3 Moyenne

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to trigger excessive resource consumption, potentially leading to reduced availability of the affected service.

  27. CVE-2026-9336 7.5 Élevée

    IBM WebSphere Application Server

    IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sending a specially-crafted HTTP request to an administrative endpoint. A remote attacker could exploit this vulnerability to cause the server to exhaust filesystem space.