Osgeo vulnerabilities

Products

• Mapserver 22
• Geoserver 18
• Gdal 13
• Geonetwork 4
• Owslib 2

Newest

• osgeo geoserver, geoserver org.geoserver.web:gs-web-app, org.geoserver:gs-main +2 more GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution CVE-2025-58175 Fix available 6.5 MediumJune 12, 2026
• osgeo geoserver, geoserver org.geoserver.web:gs-web-app, org.geoserver.web:gs-web-sec-core +2 more GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page CVE-2025-52465 Fix available 7.2 HighJune 12, 2026
• osgeo geoserver, geoserver org.geoserver.extension:gs-db2 +1 more GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection CVE-2025-27511 Fix available 7.2 HighJune 11, 2026
• mapserver MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY` CVE-2026-45104 Fix available 7.5 HighMay 27, 2026
• gdal GDAL: scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow CVE-2026-49014 Fix available 7.4 HighMay 27, 2026
• osgeo gdal OSGeo gdal Grid File GDapi.c GDSDfldsrch heap-based overflow CVE-2026-8213 Fix available 4.8 MediumMay 9, 2026
• osgeo gdal OSGeo gdal SWapi.c SWSDfldsrch heap-based overflow CVE-2026-8212 Fix available 4.8 MediumMay 9, 2026
• mapserver MapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewer CVE-2026-42030 Fix available 6.1 MediumMay 8, 2026
• osgeo gdal OSGeo gdal GDapi.c GDfieldinfo out-of-bounds CVE-2026-8088 Fix available 4.8 MediumMay 7, 2026
• osgeo gdal OSGeo gdal GDapi.c GDnentries heap-based overflow CVE-2026-8087 Fix available 4.8 MediumMay 7, 2026
• osgeo gdal OSGeo gdal SWapi.c SWnentries heap-based overflow CVE-2026-8086 Fix available 4.8 MediumMay 7, 2026
• osgeo gdal OSGeo gdal HDF-EOS Grid File SWapi.c memmove out-of-bounds CVE-2026-8084 Fix available 4.8 MediumMay 7, 2026
• mapserver MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing CVE-2026-33721 Fix available 5.3 MediumMarch 27, 2026
• osgeo gdal GDAL Bundled zlib (inftree9.c) Pointer Offset Optimization Undefined Behavior Allows Heap Corruption or Remote Code Execution CVE-2026-4738 Fix available 9.4 CriticalMarch 24, 2026
• geonetwork Geonetwork 4.2.0 - XML External Entity (XXE) CVE-2022-50899 8.7 HighJanuary 13, 2026
• geoserver GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature CVE-2025-58360 In KEVPublic exploitFix available EPSS 61.2% 8.2 HighNovember 25, 2025
• mapserver MapServer - WFS XML Filter Query SQL injection CVE-2025-59431 Fix available 8.9 HighSeptember 19, 2025
• geoserver, geotools, osgeo geonetwork +2 more GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling CVE-2025-30220 Fix available EPSS 43.6% 9.9 CriticalJune 10, 2025
• geoserver GeoServer has an Infinite Loop Vulnerability in Jiffle process CVE-2025-30145 Fix available 7.5 HighJune 10, 2025
• geoserver GeoServer Missing Authorization on REST API Index CVE-2025-27505 Fix available 5.3 MediumJune 10, 2025
• geoserver GeoServer Coverage REST API Allows Server Side Request Forgery CVE-2024-40625 Fix available 5.5 MediumJune 10, 2025
• geoserver GWC Home Page communicate version and revision information CVE-2024-38524 Fix available 5.3 MediumJune 10, 2025
• geoserver GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF) CVE-2024-34711 Fix available 9.3 CriticalJune 10, 2025
• geoserver GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost CVE-2024-29198 Fix available 7.5 HighJune 10, 2025
• osgeo gdal Buffer Overflow vulnerability in gdal 3.10.2 allows a local attacker to cause a denial of service... CVE-2025-29480 Fix availableDisputed 5.5 MediumApril 7, 2025
• osgeo geonetwork, geonetwork core-geonetwork +1 more GeoNetwork vulnerable to search end-point information disclosure in response headers CVE-2024-32037 Fix available 0.0 NoneFebruary 11, 2025
• geoserver Welcome and About GeoServer pages communicate version and revision information CVE-2024-35230 Fix available 5.3 MediumDecember 16, 2024
• geoserver, geotools +1 more Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver CVE-2024-36401 In KEVPublic exploitFix available EPSS 99.8% 9.8 CriticalJuly 1, 2024
• geoserver WPS Server Side Request Forgery in GeoServer CVE-2023-43795 Fix available EPSS 69.0% 8.6 HighOctober 24, 2023
• geoserver Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer CVE-2023-41339 Fix available 8.6 HighOctober 24, 2023
• geopython owslib XML External Entity (XXE) Injection in OWSLib CVE-2023-27476 Fix available 8.2 HighMarch 7, 2023
• geoserver Unfiltered SQL Injection Vulnerabilities in Geoserver CVE-2023-25157 Public exploitFix available EPSS 85.2% 9.8 CriticalFebruary 21, 2023
• osgeo geonetwork A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to execute arbitrary OS commands remotely on the hosting infrastructure. A User Adm… CVE-2021-28398 7.2 HighSeptember 5, 2022
• osgeo geoserver GeoServer allows SSRF via the option for setting a proxy host CVE-2021-40822 Public exploit EPSS 19.3% 7.5 HighMay 1, 2022
• geoserver Improper Input Validation in GeoServer CVE-2022-24847 Fix available 7.2 HighApril 13, 2022
• geosolutions-it jai-ext Improper Control of Generation of Code in jai-ext CVE-2022-24816 In KEVPublic exploitFix available EPSS 99.9% 10.0 CriticalApril 13, 2022
• osgeo shapelib A double-free condition exists in contrib/shpsort.c of shapelib 1.5.0 and older releases. This... CVE-2022-0699 Fix available 9.8 CriticalMarch 2, 2022
• osgeo gdal, debian linux, fedoraproject fedora +1 more +3 more GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile ... CVE-2021-45943 Fix available 5.5 MediumDecember 31, 2021
• osgeo owslib, pywps, debian linux +2 more XML External Entity Injection in PyWPS CVE-2021-39371 Fix available 7.5 HighAugust 23, 2021
• osgeo gdal netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4_get_att (called from... CVE-2019-25050 Fix available 7.8 HighJuly 20, 2021
• osgeo mapserver, fedoraproject fedora +1 more MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and... CVE-2021-32062 Fix available 5.3 MediumMay 5, 2021
• osgeo mapserver Mapserver 5.2, 5.4 and 5.6 before 5.6.5-2 improperly validates symbol index values during Mapfile... CVE-2010-1678 Fix available 7.5 HighOctober 29, 2019
• osgeo gdal, debian linux, fedoraproject fedora +3 more +5 more GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the... CVE-2019-17545 Fix available 9.8 CriticalOctober 14, 2019
• libtiff, osgeo gdal +1 more tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has... CVE-2019-17546 Fix available 8.8 HighOctober 14, 2019
• osgeo mapserver, debian linux +1 more Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5,... CVE-2017-5522 Fix available 9.8 CriticalJanuary 19, 2017
• osgeo mapserver In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive... CVE-2016-9839 Fix available 7.5 HighDecember 7, 2016
• osgeo mapserver SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in... CVE-2013-7262 Fix available 6.8 MediumJanuary 5, 2014
• osgeo mapserver Double free vulnerability in the msAddImageSymbol function in mapsymbol.c in MapServer before 6.0... CVE-2011-2975 Public exploitFix available 6.8 MediumAugust 1, 2011
• osgeo mapserver Stack-based buffer overflow in MapServer before 4.10.7 and 5.x before 5.6.7 allows remote... CVE-2011-2704 Fix available 7.5 HighJuly 26, 2011
• osgeo mapserver Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x... CVE-2011-2703 Fix available 7.5 HighJuly 26, 2011
• Show olderLoading…