CVE-2026-11714High· 8.5▾ TwilightIBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.4%
IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled.
websphere_application_server >= 17.0.0.3, < 26.0.0.8Upgrade past the affected range:
websphere_application_server 26.0.0.8Connected by shared product, vendor, weakness, or advisory.
CVE-2026-9667Medium· 5.3IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints.
CVE-2025-68616High· 7.5WeasyPrint helps web developers to create PDF documents
CVE-2026-15328High· 7.4IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling.
CVE-2026-15064High· 8.7IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.
CVE-2026-14981High· 7.5IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits.
CVE-2026-16426Medium· 6.5IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery (SSRF)