Wso2 Open Banking Km vulnerabilities

• wso2 api control plane, api manager, identity server +7 more +9 more Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products CVE-2025-15039 9.4 CriticalAugust 6, 2026
• wso2 api manager, api control plane, identity server +7 more +9 more Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products CVE-2025-9312 9.8 CriticalNovember 18, 2025
• wso2 api manager, api manager analytics, api control plane +19 more +21 more Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs CVE-2025-9804 9.6 CriticalOctober 16, 2025
• wso2 api control plane, api manager, identity server +8 more +10 more Potential Broken Access Control in Multiple WSO2 Products via System REST APIs CVE-2025-10611 9.8 CriticalOctober 16, 2025
• wso2 identity server, identity server as key manager, open banking iam +2 more +4 more Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services CVE-2024-7073 6.5 MediumJune 2, 2025
• wso2 api manager, identity server, identity server as key manager +4 more +6 more Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup CVE-2024-7097 4.3 MediumMay 30, 2025
• wso2 api manager, identity server, identity server as key manager +4 more +6 more Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw CVE-2024-7096 Fix available 4.2 MediumMay 30, 2025
• wso2 api manager, identity server, identity server as key manager +6 more +8 more Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover CVE-2024-6914 9.8 CriticalMay 22, 2025
• wso2 api manager, enterprise integrator, identity server +6 more +8 more Certain WSO2 products allow unrestricted file upload with resultant remote code execution. This... CVE-2022-29464 In KEVPublic exploit EPSS 100.0% 9.8 CriticalApril 18, 2022