CVE-2026-95695

CriticalCVSS 9.1/10Last modified Oct 22, 2026

Description

IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-956967.5IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an CVE-2026-956975.3MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unco CVE-2026-956985.3The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a CVE-2026-956999.6Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can ex CVE-2026-95707.1The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a fron CVE-2026-957015.1In MISP, the __statisticsOrgs method in UsersController.php used the organization name directly as a file-system path component when checkin CVE-2026-957028.5Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard cont CVE-2026-957035.1In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem probes (file_exists, MI CVE-2026-957047.2A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to CVE-2026-957057.2Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to pe CVE-2026-957067.2Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to pe CVE-2026-957077.2A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve r