Skip to content
Noroxi

wso2 records

139 published records for vendor wso2.

Researcher profile

Entered KEV
2 · 1.4%
Weaponized
2 · 1.4%
Pre-auth RCE
3
With a fix record
9.4%
Median publish → KEV
28 days

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 25
  9. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

139 records
  • CVE-2022-29464
    99Now

    Certain WSO2 products allow unrestricted file upload with resultant remote code execution.

    CriticalCVSS 9.8KEVWeaponizedEPSS 100%

    wso2 · api managerApr 18, 2022

  • CVE-2026-5430
    70This week

    Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

    CriticalCVSS 10.0KEVWeaponizedEPSS 1%

    wso2 · api control planeAug 6, 2026

  • CVE-2020-24589
    44Plan

    The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks.

    CriticalCVSS 9.1Proof of conceptEPSS 26%

    wso2 · api managerAug 21, 2020

  • CVE-2022-39810
    41Plan

    An issue was discovered in WSO2 Enterprise Integrator 6.4.0.

    MediumCVSS 6.1No exploitEPSS 57%

    wso2 · enterprise integratorSep 9, 2022

  • CVE-2020-13226
    40Plan

    WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this

    CriticalCVSS 9.8No exploitEPSS 2%

    wso2 · api managerMay 20, 2020

  • CVE-2026-2053
    40Plan

    Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager

    CriticalCVSS 10.0No exploitEPSS 0%

    wso2 · api managerJun 26, 2026

  • CVE-2025-10611
    39Monitor

    Potential Broken Access Control in Multiple WSO2 Products via System REST APIs

    CriticalCVSS 9.8No exploitEPSS 1%

    wso2 · api control planeOct 16, 2025

  • CVE-2024-6914
    39Monitor

    Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover

    CriticalCVSS 9.8No exploitEPSS 1%

    wso2 · api managerMay 22, 2025

  • CVE-2025-9152
    39Monitor

    Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint

    CriticalCVSS 9.8No exploitEPSS 1%

    wso2 · api control planeOct 16, 2025

  • CVE-2026-1728
    39Monitor

    Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover

    CriticalCVSS 9.8No exploitEPSS 0%

    wso2 · api control planeAug 6, 2026

  • CVE-2025-9312
    39Monitor

    Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products

    CriticalCVSS 9.8No exploitEPSS 0%

    wso2 · api control planeNov 18, 2025

  • CVE-2021-42646
    37Monitor

    XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2.

    CriticalCVSS 9.1No exploitEPSS 4%

    wso2 · api managerMay 11, 2022

  • CVE-2025-15039
    37Monitor

    Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

    CriticalCVSS 9.4No exploitEPSS 1%

    wso2 · api control planeAug 6, 2026

  • CVE-2022-29548
    36Monitor

    A reflected XSS issue exists in the Management Console of several WSO2 products.

    MediumCVSS 6.1Proof of conceptEPSS 41%

    wso2 · api managerApr 20, 2022

  • CVE-2016-4311
    36Monitor

    Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote attackers to hijack th

    HighCVSS 8.8Proof of conceptEPSS 3%

    wso2 · identity serverFeb 16, 2017

  • CVE-2025-2905
    36Monitor

    An XML External Entity (XXE) vulnerability in Multiple WSO2 Products

    CriticalCVSS 9.1No exploitEPSS 1%

    wso2 · api managerMay 5, 2025

  • CVE-2020-24590
    36Monitor

    The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks.

    CriticalCVSS 9.1No exploitEPSS 1%

    wso2 · api managerAug 21, 2020

  • CVE-2025-10713
    36Monitor

    XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration

    CriticalCVSS 9.1No exploitEPSS 0%

    wso2 · api control planeNov 5, 2025

  • CVE-2024-2374
    36Monitor

    XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service

    CriticalCVSS 9.1No exploitEPSS 0%

    wso2 · api managerApr 16, 2026

  • CVE-2020-24703
    35Monitor

    An issue was discovered in certain WSO2 products.

    HighCVSS 8.8No exploitEPSS 1%

    wso2 · api managerAug 27, 2020

  • CVE-2020-24705
    35Monitor

    An issue was discovered in certain WSO2 products.

    HighCVSS 8.8No exploitEPSS 1%

    wso2 · api managerAug 27, 2020

  • CVE-2025-6670
    35Monitor

    Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services

    HighCVSS 8.8No exploitEPSS 0%

    wso2 · api control planeNov 18, 2025

  • CVE-2025-8325
    35Monitor

    Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations

    HighCVSS 8.8No exploitEPSS 0%

    wso2 · api control planeMay 11, 2026

  • CVE-2026-4249
    34Monitor

    Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption

    HighCVSS 8.6No exploitEPSS 1%

    wso2 · api control planeJul 6, 2026

  • CVE-2025-10470
    34Monitor

    Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability

    HighCVSS 8.6No exploitEPSS 0%

    wso2 · identity serverMay 11, 2026