Web servers and proxies: vulnerabilities and fixes

Q: How do I fix Web servers and proxies vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Q: Is Web servers and proxies being exploited right now?

Yes: 1 Web servers and proxies CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Q: Which Web servers and proxies CVE should I patch first?

CVE-2026-21962 currently ranks highest (98/100): Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability.

nginx, Apache, Tomcat, HAProxy and other servers that face the internet. 88 CVEs tracked.

Web servers and proxies has 88 tracked vulnerabilities, 27 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 66. Most recent: 2026-10-22. Highest priority: CVE-2026-21962 (score 98/100).

CVE-2026-21962 CRITICAL 10.0 EXPLOITED DOWNGRADE DOWNGRADE Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
CVE-2026-66713 CRITICAL 9.8 UPGRADE Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in Apache Software Fou
CVE-2026-41939 CRITICAL 9.8 Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.F
CVE-2026-75784 CRITICAL 10.0 A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01
CVE-2026-14512 CRITICAL 9.8 UPGRADE IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deseriali
CVE-2026-18598 HIGH 8.8 A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5
CVE-2026-18600 HIGH 8.8 A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5
CVE-2026-18599 HIGH 8.0 A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5
CVE-2026-14446 CRITICAL 9.8 UPGRADE IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in t
CVE-2026-60291 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-60292 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-60294 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-60672 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-60696 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-60698 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-60977 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Component
CVE-2026-60198 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-60199 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-60200 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-60202 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-60204 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-60205 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-18753 CRITICAL 9.1 The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS
CVE-2026-18754 CRITICAL 9.1 The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS
CVE-2026-14974 HIGH 8.1 UPGRADE IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary c
CVE-2026-60208 CRITICAL 9.1 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-93895 CRITICAL 9.1 UPGRADE IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote a
CVE-2026-93909 CRITICAL 9.1 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypas
CVE-2026-110354 HIGH 7.5 HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worke
CVE-2026-110353 HIGH 7.5 HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread
CVE-2026-60206 CRITICAL 9.9 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-60293 HIGH 8.6 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS - Web Services
CVE-2026-60699 HIGH 8.6 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-60702 CRITICAL 9.9 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-15567 HIGH 7.5 A flaw was found in Wildfly
CVE-2026-55676 HIGH 8.8 Malcolm is a network traffic analysis tool suite
CVE-2026-68005 HIGH 7.5 An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP
CVE-2026-114638 HIGH 8.7 Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGIN
CVE-2026-11536 HIGH 8.5 UPGRADE IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP
CVE-2026-11897 HIGH 7.5 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, cau
CVE-2026-15280 HIGH 7.5 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a
CVE-2026-60415 HIGH 8.1 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-15057 HIGH 7.5 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due
CVE-2026-60201 HIGH 8.1 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-60312 HIGH 8.1 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-11707 CRITICAL 9.3 UPGRADE UPGRADE IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cro
CVE-2026-14528 HIGH 7.4 UPGRADE IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive in
CVE-2026-16184 HIGH 7.0 UPGRADE IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sendin
CVE-2026-60203 HIGH 8.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-60207 HIGH 8.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-60313 HIGH 8.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-60343 HIGH 8.8 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-66299 MEDIUM 5.3 UPGRADE Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects
CVE-2026-93905 HIGH 8.2 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote at
CVE-2026-14980 HIGH 8.3 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forge
CVE-2026-114642 HIGH 8.7 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a clie
CVE-2026-14976 HIGH 7.1 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with
CVE-2026-18499 HIGH 8.1 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation w
CVE-2026-60196 HIGH 8.4 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-95695 HIGH 7.4 UPGRADE IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass
CVE-2026-60680 HIGH 8.1 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-65600 MEDIUM 5.3 UPGRADE Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass v
CVE-2026-91502 HIGH 7.3 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-60153 HIGH 7.2 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
CVE-2026-60529 HIGH 7.2 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
CVE-2026-24330 MEDIUM 6.5 A flaw was found in wildfly-core
CVE-2026-95696 MEDIUM 6.5 UPGRADE IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause
CVE-2026-112778 HIGH 8.8 UPGRADE Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotat
CVE-2026-60679 HIGH 7.5 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)
CVE-2026-15396 MEDIUM 6.5 IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through
CVE-2026-15412 MEDIUM 6.5 IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through
CVE-2026-15634 MEDIUM 6.5 IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through
CVE-2026-16192 HIGH 7.1 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulner
CVE-2026-60528 HIGH 7.6 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
CVE-2026-63177 HIGH 7.1 Malcolm is a network traffic analysis tool suite
CVE-2026-11549 MEDIUM 6.5 IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through
CVE-2026-18673 MEDIUM 5.3 When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readine
CVE-2026-9031 MEDIUM 6.8 An input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation of user-s
CVE-2026-14515 MEDIUM 6.1 UPGRADE IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-sit
CVE-2026-60527 HIGH 7.1 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console)
CVE-2026-9030 MEDIUM 6.8 A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instr
CVE-2026-10841 MEDIUM 4.8 IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through
CVE-2026-11548 MEDIUM 4.8 IBM WebSphere Application Server 8.5 and 9.0, and and IBM WebSphere Application Server - Liberty 17.0.0.3 thro
CVE-2026-11722 MEDIUM 4.8 IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through
CVE-2026-11383 MEDIUM 5.4 UPGRADE UPGRADE IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross
CVE-2026-12495 MEDIUM 5.3 Denial-of-service (DoS) vulnerability due to a stack buffer overflow in the http_gdpr_decrypt function of the
CVE-2026-25552 LOW 3.7 Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to
CVE-2026-2482 LOW 3.1 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forge

FAQ

How do I fix Web servers and proxies vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Web servers and proxies being exploited right now?

Yes: 1 Web servers and proxies CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which Web servers and proxies CVE should I patch first?

CVE-2026-21962 currently ranks highest (98/100): Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability.

Software in this group

Oracle WebLogic 34 IBM WebSphere 29 Apache HTTP Server 8 nginx 5 Traefik 4 JBoss and WildFly 3 Apache Tomcat 2 HAProxy 2 lighttpd 2 Apache Tomcat 2 Envoy 1

People search for: nginx, apache, tomcat, web server, proxy.

← Back to latest CVEs