Skip to contentWso2 Api Control Plane vulnerabilities
- wso2 api manager, api control plane, identity server key manager connector (apim-km-wso2is) +2 morePrivilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)CVE-2026-40529.8 Critical
- wso2 api control plane, api manager, identity server +2 moreReflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI ModificationCVE-2025-57696.1 Medium
- wso2 jwt grant type for oauth2, api control plane, api manager +7 more +9 moreImproper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity ProvidersCVE-2025-13974.8 Medium
- wso2 api control plane, api manager, carbon oauth +6 more +8 moreImproper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked AccountsCVE-2024-95174.9 Medium
- wso2 api control plane, api manager, carbon api management implementation +2 more +4 moreSQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service DisruptionCVE-2026-26138.7 High
- wso2 api control plane, api manager, carbon event publisher core +6 more +8 moreInformation Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive DataCVE-2026-188004.4 Medium
- wso2 api manager, api control plane, carbon api manager rest api common functions +6 more +8 moreBroken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative ActionsCVE-2025-119699.4 Critical
- wso2 api control plane, api manager, carbon oauth +6 more +8 moreImproper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]CVE-2026-35833.1 Low
- wso2 api control plane, api manager, identity server +2 moreCross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 ProductsCVE-2026-118546.1 Medium
- wso2 api control plane, api manager, carbon oauth +6 more +8 moreImproper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session TerminationCVE-2025-131736.5 Medium
- wso2 api control plane, api manager, carbon identity api server configs v1 +5 more +7 moreSensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of CredentialsCVE-2025-72034.9 Medium
- wso2 forgerock key manager component, api control plane, api manager +1 more +3 moreRefresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource ConsumptionCVE-2025-70435.4 Medium
- wso2 api control plane, api manager, carbon event publisher ui +3 more +5 moreStored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and RedirectionCVE-2025-66234.3 Medium
- wso2 api control plane, api manager, carbon identity application authentication framework +7 more +9 moreUsername Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account DiscoveryCVE-2025-58025.3 Medium
- wso2 api control plane, api manager +1 moreCross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script ExecutionCVE-2026-41036.4 Medium
- wso2 api control plane, api manager +1 moreReverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential TheftCVE-2026-30964.7 Medium
- wso2 api control plane, api manager, identity server +5 more +7 moreArbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code ExecutionCVE-2025-127378.4 High
- wso2 api control plane, api manager +1 morePredictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event PayloadsCVE-2026-34165.9 Medium
- wso2 api control plane, api manager, api manager publisher rest api v4 +4 more +6 moreArbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code ExecutionCVE-2026-34189.1 Critical
- wso2 api control plane, api manager, carbon api gateway +3 more +5 moreXML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of ServiceCVE-2026-34158.7 High
- wso2 api control plane, api manager, carbon api management implementation +3 more +5 moreAccess Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant OperationsCVE-2025-145619.0 Critical
- wso2 api control plane, api manager, multiple products +3 more +5 moreAuthentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account TakeoverCVE-2026-5430In KEVPublic exploitEPSS 22.4%10.0 Critical
- wso2 api control plane, api manager, traffic manager +3 more +5 morePrivilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account TakeoverCVE-2026-17289.8 Critical
- wso2 api control plane, api manager, identity server +7 more +9 moreAccount Takeover via Conditional Authentication Script Logic in Multiple WSO2 ProductsCVE-2025-150399.4 Critical
- wso2 api control plane, api manager, identity server +5 more +7 moreHeader Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log ForgeryCVE-2026-06375.4 Medium
- wso2 api control plane, api manager, enterprise integrator +44 more +46 moreCross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized ActionsCVE-2025-133945.4 Medium
- wso2 api control plane, api manager, identity server +5 more +7 moreImproper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data ExposureCVE-2024-103024.0 Medium
- wso2 api control plane, api manager, identity server +7 more +9 moreAccount Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force AttacksCVE-2024-68325.9 Medium
- wso2 api control plane, api manager, identity server +6 more +8 moreAuthorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized AccessCVE-2024-89954.9 Medium
- wso2 api control plane, api manager, identity server +2 moreReflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and ModificationCVE-2026-24456.1 Medium
- wso2 api control plane, api manager, traffic manager +1 more +3 moreDenial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service DisruptionCVE-2026-42498.6 High
- wso2 api control plane, api manager, identity server +5 more +7 moreReflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI ModificationCVE-2025-85916.1 Medium
- wso2 api control plane, api manager, traffic manager +3 more +5 moreImproper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized OperationsCVE-2025-83256.3 Medium
- wso2 api control plane, api manager, traffic manager +3 more +5 moreHTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header ManipulationCVE-2025-81545.3 Medium
- wso2 api control plane, api manager, org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl +2 more +4 moreAuthenticated arbitrary file upload via a System REST API requiring administrator permission.CVE-2025-13590Fix available9.1 Critical
- wso2 api manager, api control plane, identity server +7 more +9 moreImproper Certificate-Based Authentication Enforcement in Multiple WSO2 ProductsCVE-2025-93129.8 Critical
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreCross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin ServicesCVE-2025-66708.8 High
- wso2 api control plane, api manager, enterprise integrator +10 more +12 moreReflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output EncodingCVE-2025-108535.2 Medium
- wso2 api control plane, api manager, identity server +2 moreReflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 ProductsCVE-2025-57706.1 Medium
- wso2 api manager, enterprise integrator, micro integrator +8 more +10 moreArbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)CVE-2025-110938.4 High
- wso2 api control plane, api manager, enterprise integrator +15 more +17 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code ExecutionCVE-2025-109078.4 High
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreXML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser ConfigurationCVE-2025-10713Fix available6.5 Medium
- wso2 api control plane, api manager, enterprise integrator +6 more +8 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code ExecutionCVE-2025-31256.7 Medium
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreAuthentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information DisclosureCVE-2025-56054.3 Medium
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreSSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 ProductsCVE-2025-53505.9 Medium
- wso2 api manager, api control plane +1 moreImproper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR EndpointCVE-2025-91529.8 Critical
- wso2 api manager, api manager analytics, api control plane +19 more +21 moreImproper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIsCVE-2025-98049.6 Critical
- wso2 api control plane, api manager, identity server +8 more +10 morePotential Broken Access Control in Multiple WSO2 Products via System REST APIsCVE-2025-106119.8 Critical
- wso2 api control plane, api manager, open banking am +2 more +4 moreAuthenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin ServiceCVE-2025-57176.8 Medium
- wso2 api control plane, api manager, traffic manager +2 more +4 moreAuthenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in PublisherCVE-2025-4760Fix available4.8 Medium
- Show olderLoading…