Skip to contentWso2 vulnerabilities
Products
Show 7 moreShow less
Newest
- wso2 api control plane, api manager, traffic manager +3 more +5 morePrivilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account TakeoverCVE-2026-17289.8 Critical
- wso2 api control plane, api manager, identity server +7 more +9 moreAccount Takeover via Conditional Authentication Script Logic in Multiple WSO2 ProductsCVE-2025-150399.4 Critical
- wso2 api control plane, api manager, identity server +5 more +7 moreHeader Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log ForgeryCVE-2026-06375.4 Medium
- wso2 api control plane, api manager, enterprise integrator +44 more +46 moreCross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized ActionsCVE-2025-133945.4 Medium
- wso2 identity server, email otp authenticator, carbon abstract otp authenticator +2 more +4 moreInformation Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII ExposureCVE-2025-139094.3 Medium
- wso2 identity server, carbon oauth +1 moreImproper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized ActionsCVE-2025-126272.4 Low
- wso2 identity server, carbon identity api server secret management common, carbon identity api server secret management v1 +2 moreImproper Access Control via Secret Type Management API in WSO2 Identity ServerCVE-2025-147793.8 Low
- wso2 identity server, token exchange grant type for oauth +1 moreImproper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]CVE-2025-118504.3 Medium
- wso2 api manager, identity server, identity server as key manager +2 more +4 moreUsername Enumeration via Login Interface in Multiple WSO2 Products Allows User Account DiscoveryCVE-2025-137363.7 Low
- wso2 api control plane, api manager, identity server +5 more +7 moreImproper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data ExposureCVE-2024-103024.0 Medium
- wso2 api control plane, api manager, identity server +7 more +9 moreAccount Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force AttacksCVE-2024-68325.9 Medium
- wso2 api control plane, api manager, identity server +6 more +8 moreAuthorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized AccessCVE-2024-89954.9 Medium
- wso2 api control plane, api manager, identity server +2 moreReflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and ModificationCVE-2026-24456.1 Medium
- wso2 api control plane, api manager, traffic manager +1 more +3 moreDenial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service DisruptionCVE-2026-42498.6 High
- wso2 api control plane, api manager, identity server +5 more +7 moreReflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI ModificationCVE-2025-85916.1 Medium
- wso2 api manager, identity server, identity server as key manager +2 more +4 moreRole Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege EscalationCVE-2024-12484.8 Medium
- wso2 api manager, identity server +1 moreCross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data ExposureCVE-2025-134753.5 Low
- wso2 api managerUnauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API ManagerCVE-2026-20538.3 High
- wso2 identity server, carbon magiclink authenticator module +1 moreDenial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service UnavailabilityCVE-2025-104708.6 High
- wso2 identity server, conditional authentication user and roles related functions +1 moreAuthorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account TakeoverCVE-2025-99736.4 Medium
- wso2 api control plane, api manager, traffic manager +3 more +5 moreImproper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized OperationsCVE-2025-83256.3 Medium
- wso2 api control plane, api manager, traffic manager +3 more +5 moreHTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header ManipulationCVE-2025-81545.3 Medium
- wso2 identity server, carbon magiclink authenticator module +1 moreAccount Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized AccessCVE-2025-109087.3 High
- wso2 email otp authenticator, identity server, identity server as key manager +2 more +4 moreUsername Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account DiscoveryCVE-2024-03915.3 Medium
- wso2 identity serverReflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity ServerCVE-2025-105036.1 Medium
- wso2 identity serverImproper Token Invalidation in WSO2 Identity Server Allows Access After Account LockCVE-2025-126246.0 Medium
- wso2 api manager, identity server +1 moreCross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious WebsitesCVE-2025-60246.1 Medium
- wso2 api managerReflected Cross-Site Scripting via Authentication Endpoint in WSO2 API Manager Allows UI Modification and RedirectionCVE-2024-102426.1 Medium
- wso2 api managerXML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary FilesCVE-2024-80103.5 Low
- wso2 api managerCross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information RetrievalCVE-2024-48675.4 Medium
- wso2 api manager, identity server, identity server as key manager +2 more +4 moreXML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of ServiceCVE-2024-23747.5 High
- wso2 api manager, identity server +1 moreA local user can be impersonated when using federated authentication with Silent JIT Provisioning.CVE-2024-15247.7 High
- wso2 api control plane, api manager, org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl +2 more +4 moreAuthenticated arbitrary file upload via a System REST API requiring administrator permission.CVE-2025-13590Fix available9.1 Critical
- wso2 identity serverServer-Side Template Injection via Velocity Template Engine in Multiple WSO2 Products Allows Remote Code ExecutionCVE-2025-121078.4 High
- wso2 api manager, api control plane, identity server +7 more +9 moreImproper Certificate-Based Authentication Enforcement in Multiple WSO2 ProductsCVE-2025-93129.8 Critical
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreCross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin ServicesCVE-2025-66708.8 High
- wso2 api control plane, api manager, enterprise integrator +10 more +12 moreReflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output EncodingCVE-2025-108535.2 Medium
- wso2 api control plane, api manager, identity server +2 moreReflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 ProductsCVE-2025-57706.1 Medium
- wso2 api manager, enterprise integrator, micro integrator +8 more +10 moreArbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)CVE-2025-110938.4 High
- wso2 api control plane, api manager, enterprise integrator +15 more +17 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code ExecutionCVE-2025-109078.4 High
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreXML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser ConfigurationCVE-2025-10713Fix available6.5 Medium
- wso2 api control plane, api manager, enterprise integrator +6 more +8 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code ExecutionCVE-2025-31256.7 Medium
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreAuthentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information DisclosureCVE-2025-56054.3 Medium
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreSSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 ProductsCVE-2025-53505.9 Medium
- wso2 api manager, api control plane +1 moreImproper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR EndpointCVE-2025-91529.8 Critical
- wso2 api manager, api manager analytics, api control plane +19 more +21 moreImproper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIsCVE-2025-98049.6 Critical
- wso2 enterprise integrator, enterprise service bus, org.wso2.carbon:org.wso2.carbon.base +1 more +3 moreImproper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store ConfigurationCVE-2025-99555.7 Medium
- wso2 api control plane, api manager, identity server +8 more +10 morePotential Broken Access Control in Multiple WSO2 Products via System REST APIsCVE-2025-106119.8 Critical
- wso2 enterprise integrator, identity server, identity server as key manager +1 more +3 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code ExecutionCVE-2025-18626.7 Medium
- wso2 identity server, identity server as key manager, open banking iam +2 moreUsername Enumeration in Multiple WSO2 Products with Multi-Attribute Login EnabledCVE-2025-13963.7 Low
- Show moreLoading…