Websphere Application Server Liberty
Vendor:
First CVE: Aug 16, 2023 · Active for 2 years
11
Total CVEs
More Total CVEs than 90% of tracked products
2.8
Avg CVEs / Year
Higher CVE frequency than 78% of tracked products
7.1
Avg CVSS
Higher Avg CVSS than 45% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Websphere Application Server Liberty over time
Volume of CVEsAvg CVSS Base Score
First CVE
Aug 16, 2023
2 years ago
Most Recent CVE
Mar 25, 2026
125 days ago
CVE Severity & Scoring
Websphere Application Server Liberty11 CVEs
36%
55%
9%
All CVEs353,240 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network10 (90.9%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network1 (9.1%)
Attack Complexity
Low10 (90.9%)
High1 (9.1%)
Unknown0 (0.0%)
User Interaction
None8 (72.7%)
Unknown0 (0.0%)
Required3 (27.3%)
Privileges Required
Low1 (9.1%)
High2 (18.2%)
None8 (72.7%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-14914HIGH IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive containing path traversal sequences resulting in an overwri | Feb 2, 2026 | 7.6 | 25 | NO | NO |
CVE-2025-36124HIGH IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a failure to honor JMS messaging configur | Aug 12, 2025 | 7.5 | 25 | NO | NO |
CVE-2025-36047HIGH IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could expl | Aug 14, 2025 | 7.5 | 24 | NO | NO |
CVE-2023-46158CRITICAL IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security due to improper resource expiration handling. IBM X-Force ID: 2687 | Oct 25, 2023 | 9.8 | 24 | NO | NO |
CVE-2024-22353HIGH IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could expl | Mar 31, 2024 | 7.5 | 23 | NO | NO |
CVE-2024-27268HIGH IBM WebSphere Application Server Liberty 18.0.0.2 through 24.0.0.4 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could expl | Apr 4, 2024 | 7.5 | 22 | NO | NO |
CVE-2023-38737HIGH IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exp | Aug 16, 2023 | 7.5 | 22 | NO | NO |
CVE-2026-1561MEDIUM IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is vulnerable to server-side request forgery (SSRF). This may allow re | Mar 25, 2026 | 5.4 | 21 | NO | NO |
CVE-2024-27270MEDIUM IBM WebSphere Application Server Liberty 23.0.0.3 through 24.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in a sp | Mar 27, 2024 | 6.1 | 20 | NO | NO |
CVE-2023-50312MEDIUM IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.2 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user config | Mar 1, 2024 | 6.5 | 20 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (11 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (11 CVEs).
Media Mentions
Signals from CVEs in this product scope (11 CVEs).
Top CNAs Publishing CVEs For Websphere Application Server Liberty
Top CWEs
Versions
No cataloged versions.