Threats affecting pkg:maven/com.ibm.websphere/websphere-application-server

22 threats

Severity	CVSS	Signals	Threat	Source	Published
Critical	9.0	EPSS 0.5%	CVE-2026-9319IBM WebSphere Application Server · Deserialization of Untrusted Data Critical9.0EPSS 0.5%2026-06-01CVE Database V5CVE-2026-9319 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security. EPSS 0.5%Vulnerability CWE-502	CVE Database V5	2026-06-01
Medium	5.4	EPSS 0.2%	CVE-2025-12635IBM WebSphere Application Server · Cross-site Scripting Medium5.4EPSS 0.2%2025-12-08CVE Database V5CVE-2025-12635 IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to improper validation of user-supplied input. An attacker could exploit this vulnerability by using a specially crafted URL to redirect the user to a malicious site. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2025-12-08
Critical	9.0	EPSS 13%	CVE-2025-36038IBM WebSphere Application Server · Deserialization of Untrusted Data Critical9.0EPSS 13%2025-06-25CVE Database V5CVE-2025-36038 IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects. EPSS 13%Vulnerability CWE-502	CVE Database V5	2025-06-25

Page 2 of 2