Login Request a demo
WE
Product
WebSphere Extreme Scale
by IBM · last CVE Jun 30, 2026
23
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities23In the news0Timeline
Severity mix
Critical 2High 1Medium 7Low 2
Severity
All severities23Critical2High1Medium7Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add WebSphere Extreme Scale to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-13773
10.0
6%
Jun 30
IBM WebSphere eXtreme Scale is affected by server side request forgery when ORB is used as Transport Protocol
Affected: 8.6.1.0 through 8.6.1.6
CVE-2026-13772
9.9
1%
Jun 30
IBM WebSphere eXtreme Scale's OQL is affected by remote code execution
Affected: 8.6.1.0 through 8.6.1.6
CVE-2026-13759
8.8
1%
Jun 30
IBM WebSphere eXtreme Scale is affected by Insecure Deserilization
Affected: 8.6.1.0 through 8.6.1.6
CVE-2026-9002
6.5
0%
Jun 30
IBM WebSphere eXtremes Scale is affected by uncontrolled resource consumption when XDF is enabled
Affected: 8.6.1.0 through 8.6.1.6
CVE-2019-4109
6.1
1%
Sep 30
IBM WebSphere eXtreme Scale 8.6 Admin Console could allow a remote attacker to hijack the clicking action of the victim
Affected: 8.6.0 before 8.6.1.3
CVE-2016-0400
6.1
2%
Jul 2
CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 allows remote attackers to…
Affected: 7.1.0; 7.1.0.2; 7.1.1; 8.5.0; 8.5.0.1; 8.5.0.2; +8 more
CVE-2019-4115
5.4
1%
Sep 30
IBM WebSphere eXtreme Scale 8.6 Admin API is vulnerable to cross-site scripting
Affected: 8.6.0 before 8.6.1.3
CVE-2020-4336
5.3
1%
Jan 6
IBM WebSphere eXtreme Scale 8.6.1 stores sensitive information in URL parameters
Affected: 8.6.1.0 before 8.6.1.4
CVE-2019-4106
4.8
1%
Sep 30
IBM WebSphere eXtreme Scale 8.6 Admin Console is vulnerable to cross-site scripting
Affected: 8.6.0 before 8.6.1.3
CVE-2015-7418
4.4
0%
Feb 8
IBM WebSphere eXtreme Scale and the WebSphere DataPower XC10 Appliance allow some sensitive data to linger in memory instead of being overwritten which could allow a local user…
Affected: 7.1.0; 7.1.1; 8.5; 8.6
CVE-2016-2861
3.7
1%
Jul 2
IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 does not properly encrypt data, which makes it easier for remote…
Affected: 7.1.0; 7.1.0.2; 7.1.1; 8.5.0; 8.5.0.1; 8.5.0.2; +9 more
CVE-2019-4112
3.3
0%
Sep 30
IBM WebSphere eXtreme Scale 8.6 Admin Console allows web pages to be stored locally which can be read by another user on the system
Affected: 8.6.0 before 8.6.1.3
CVE-2015-2031
–
1%
Oct 4
Cross-site scripting (XSS) vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote authenticated users to inject arbitrary web…
Affected: 7.1.0; 7.1.0.2; 7.1.1
CVE-2015-2030
–
1%
Oct 4
IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 has an improper account-lockout setting, which makes it easier for remote attackers to obtain access via…
Affected: 7.1.0; 7.1.0.2; 7.1.1
CVE-2015-2029
–
1%
Oct 4
Session fixation vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to hijack web sessions via a session identifier
Affected: 7.1.0; 7.1.0.2; 7.1.1
CVE-2015-2028
–
1%
Oct 4
CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP…
Affected: 7.1.0; 7.1.0.2; 7.1.1
CVE-2015-2027
–
0%
Oct 4
IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 improperly performs logout actions, which allows remote attackers to bypass intended access restrictions…
Affected: 7.1.0; 7.1.0.2; 7.1.1
CVE-2015-2026
–
1%
Oct 4
Cross-site request forgery (CSRF) vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote authenticated users to hijack the…
Affected: 7.1.0; 7.1.0.2; 7.1.1
CVE-2015-2025
–
1%
Oct 4
IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote…
Affected: 7.1.0; 7.1.0.2; 7.1.1
CVE-2015-4936
–
1%
Aug 3
Unspecified vulnerability in IBM WebSphere eXtreme Scale 8.6 through 8.6.0.8 allows remote attackers to cause a denial of service via unknown vectors
Affected: 8.6.0.0; 8.6.0.1; 8.6.0.2; 8.6.0.3; 8.6.0.4; 8.6.0.5; +3 more
CVE-2013-5394
–
1%
Oct 16
The monitoring console in IBM WebSphere eXtreme Scale 7.1.0, 7.1.1, 8.5.0, and 8.6.0 allows remote authenticated users to conduct phishing attacks via unspecified vectors
Affected: 7.1.0; 7.1.1; 8.5.0; 8.6.0
CVE-2013-5393
–
1%
Oct 16
The monitoring console in IBM WebSphere eXtreme Scale 7.1.0, 7.1.1, 8.5.0, and 8.6.0 does not properly process logoff actions, which has unspecified impact and remote attack…
Affected: 7.1.0; 7.1.1; 8.5.0; 8.6.0
CVE-2013-5390
–
1%
Oct 16
Cross-site scripting (XSS) vulnerability in the monitoring console in IBM WebSphere eXtreme Scale 7.1.0, 7.1.1, 8.5.0, and 8.6.0 allows remote authenticated users to inject…
Affected: 7.1.0; 7.1.1; 8.5.0; 8.6.0
Showing 23