Wso2 vulnerabilities

Products

• Api Manager 95
• Api Manager 95
• Identity Server 88
• Identity Server 83
• Identity Server As Key Manager 54
• Identity Server As Key Manager 52
• Api Control Plane 51
• Open Banking Iam 51
• Open Banking Am 45
• Traffic Manager 40
• Universal Gateway 40
• Enterprise Integrator 33
• Open Banking Iam 33
• Api Control Plane 31
• Enterprise Integrator 29
• Traffic Manager 27
• Open Banking Am 26
• Universal Gateway 26
• Api Manager Analytics 11
• Api Microgateway 11
• Identity Server Analytics 11
• Open Banking Km 9
• Carbon Oauth 8
• Open Banking Km 8
• Data Analytics Server 7
• Iot Server 7
• Micro Integrator 7
• Carbon Api Management Implementation 6
• Micro Integrator 5
• Carbon Api Manager Rest Api Utility 5
• Carbon Identity Application Authentication Framework 5
• Carbon User Manager Kernel 5
• Dashboard Server 4
• Enterprise Mobility Manager 4
• Is As Key Manager 4
• Carbon 3
• Email Otp Authenticator 3
• Org.wso2.carbon:org.wso2.carbon.base 3
• Org.wso2.carbon:org.wso2.carbon.ui 3
• Carbon Identity User Store Configuration Ui 3

Show 27 moreShow less

• Carbon Magiclink Authenticator Module 3
• Enterprise Service Bus 3
• Application Server 2
• Business Process Server 2
• Business Rules Server 2
• Carbon-registry 2
• Complex Event Processor 2
• Data Services Server 2
• Enterprise Mobility Manager 2
• Enterprise Service Bus 2
• Machine Learner 2
• Message Broker 2
• Multiple Products 2
• Org.wso2.carbon:org.wso2.carbon.server.admin 2
• Api Manager Analytics 2
• Api Microgateway 2
• Carbon Abstract Otp Authenticator 2
• Carbon Api Gateway 2
• Carbon Api Management Api 2
• Carbon Api Manager Rest Api Common Functions 2
• Carbon Identity Application Authentication Endpoint(utils) 2
• Carbon Identity Management 2
• Carbon Identity Recovery Management 2
• Carbon Registry Resources Ui 2
• Carbon User Management Ui 2
• Data Analytics Server 2
• Identity Server Analytics 2

Newest

• wso2 identity server, identity application management component +1 more Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server CVE-2025-11229 7.2 HighNovember 4, 2026
• wso2 api manager, api control plane, identity server key manager connector (apim-km-wso2is) +2 more Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager) CVE-2026-4052 9.8 CriticalNovember 3, 2026
• wso2 api control plane, api manager, identity server +2 more Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modification CVE-2025-5769 6.1 MediumNovember 3, 2026
• wso2 jwt grant type for oauth2, api control plane, api manager +7 more +9 more Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers CVE-2025-1397 4.8 MediumNovember 3, 2026
• wso2 api manager, identity server, identity server as key manager +2 more Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks CVE-2024-12139 4.3 MediumNovember 2, 2026
• wso2 identity server Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks CVE-2024-12141 4.3 MediumNovember 2, 2026
• wso2 api control plane, api manager, carbon oauth +6 more +8 more Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts CVE-2024-9517 4.9 MediumNovember 2, 2026
• wso2 api manager, carbon registry kernel, enterprise integrator +4 more +6 more Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks CVE-2024-2372 5.4 MediumNovember 2, 2026
• wso2 api manager, carbon api manager publisher rest api +1 more Stored Cross-Site Scripting in Multiple WSO2 Products CVE-2025-12544 4.8 MediumNovember 2, 2026
• wso2 api control plane, api manager, carbon api management implementation +2 more +4 more SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption CVE-2026-2613 8.7 HighNovember 2, 2026
• wso2 api control plane, api manager, carbon event publisher core +6 more +8 more Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data CVE-2026-18800 4.4 MediumNovember 2, 2026
• wso2 identity server, identity server as key manager, identity server keystore rest api commons +2 more +4 more Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths CVE-2025-13647 5.8 MediumNovember 2, 2026
• wso2 api manager, carbon user management ui, enterprise integrator +1 more +3 more Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products CVE-2024-7075 4.6 MediumNovember 2, 2026
• wso2 api manager, carbon identity management, carbon user manager kernel +1 more +3 more Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks CVE-2024-5617 4.8 MediumNovember 2, 2026
• wso2 api manager, api control plane, carbon api manager rest api common functions +6 more +8 more Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions CVE-2025-11969 9.4 CriticalNovember 2, 2026
• wso2 business process server, enterprise integrator (bps profile) +1 more Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution CVE-2026-78674 8.8 HighOctober 28, 2026
• wso2 identity server, carbon oauth +1 more Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events CVE-2026-6647 7.4 HighOctober 28, 2026
• wso2 api control plane, api manager, carbon oauth +6 more +8 more Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows] CVE-2026-3583 3.1 LowOctober 28, 2026
• wso2 api control plane, api manager, identity server +2 more Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products CVE-2026-11854 6.1 MediumOctober 28, 2026
• wso2 saml2 sso authenticator ui bundle, api manager, carbon ui +4 more +6 more Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources CVE-2025-14260 8.3 HighOctober 28, 2026
• wso2 api manager, carbon identity application, carbon identity core +5 more +7 more Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage CVE-2024-6423 4.0 MediumOctober 21, 2026
• wso2 identity server, carbon oauth +1 more Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access CVE-2025-0326 7.4 HighOctober 21, 2026
• wso2 api manager, carborn identity handler, identity server +3 more +5 more Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery CVE-2024-7478 5.8 MediumOctober 21, 2026
• wso2 identity server Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks CVE-2024-5563 4.8 MediumOctober 21, 2026
• wso2 api manager Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks CVE-2024-4989 5.4 MediumOctober 21, 2026
• wso2 api manager, carbon user management ui, enterprise integrator +4 more +6 more Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection CVE-2024-5139 6.1 MediumOctober 21, 2026
• wso2 api manager, carbon user manager kernel, enterprise integrator +4 more +6 more Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery CVE-2024-2323 4.8 MediumOctober 20, 2026
• wso2 api manager, carbon identity application authentication framework, carbon identity recovery management +8 more +10 more Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations CVE-2024-4412 2.7 LowOctober 19, 2026
• wso2 api control plane, api manager, carbon oauth +6 more +8 more Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination CVE-2025-13173 6.5 MediumOctober 19, 2026
• wso2 identity server, email otp authenticator, carbon abstract otp authenticator +2 more Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery CVE-2025-13591 5.3 MediumOctober 19, 2026
• wso2 carbon scim 2.0 common component, carbon scim common component, identity server +2 more +4 more Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover CVE-2025-10149 8.2 HighOctober 19, 2026
• wso2 api control plane, api manager, carbon identity api server configs v1 +5 more +7 more Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials CVE-2025-7203 4.9 MediumOctober 19, 2026
• wso2 forgerock key manager component, api control plane, api manager +1 more +3 more Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption CVE-2025-7043 5.4 MediumOctober 19, 2026
• wso2 api control plane, api manager, carbon event publisher ui +3 more +5 more Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection CVE-2025-6623 4.3 MediumOctober 19, 2026
• wso2 api manager, carbon user manager kernel, enterprise integrator +4 more +6 more Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution CVE-2024-4457 9.1 CriticalOctober 18, 2026
• wso2 identity server Potential brute force vulnerability due to non-expiring SMS OTPs CVE-2024-8122 5.9 MediumOctober 8, 2026
• wso2 identity server Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery CVE-2025-13166 3.7 LowSeptember 15, 2026
• wso2 api control plane, api manager, carbon identity application authentication framework +7 more +9 more Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery CVE-2025-5802 5.3 MediumSeptember 15, 2026
• wso2 integrator: mi for visual studio code OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution CVE-2026-19515 7.0 HighSeptember 15, 2026
• wso2 api control plane, api manager +1 more Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution CVE-2026-4103 6.4 MediumSeptember 14, 2026
• wso2 api control plane, api manager +1 more Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft CVE-2026-3096 4.7 MediumSeptember 10, 2026
• wso2 api control plane, api manager, identity server +5 more +7 more Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution CVE-2025-12737 8.4 HighSeptember 3, 2026
• wso2 api control plane, api manager +1 more Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads CVE-2026-3416 5.9 MediumSeptember 3, 2026
• wso2 api control plane, api manager, api manager publisher rest api v4 +4 more +6 more Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution CVE-2026-3418 9.1 CriticalAugust 6, 2026
• wso2 api control plane, api manager, carbon api gateway +3 more +5 more XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service CVE-2026-3415 8.7 HighAugust 6, 2026
• wso2 api control plane, api manager, carbon api management implementation +3 more +5 more Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations CVE-2025-14561 9.0 CriticalAugust 6, 2026
• wso2 enterprise integrator, identity server +1 more Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges CVE-2025-12317 5.0 MediumAugust 6, 2026
• wso2 api manager User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requests CVE-2025-6508 4.3 MediumAugust 6, 2026
• wso2 api manager, enterprise integrator, micro integrator +1 more +3 more Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products CVE-2024-6541 6.8 MediumAugust 6, 2026
• wso2 api control plane, api manager, multiple products +3 more +5 more Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover CVE-2026-5430 In KEVPublic exploit EPSS 22.4% 10.0 CriticalAugust 6, 2026
• Show olderLoading…