Wso2 Api Manager
WSO2 · 69 CVEs
Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery
Sep 15, 2026
Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution
Sep 14, 2026
Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft
Sep 10, 2026
Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution
Sep 3, 2026
Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged E…
Sep 3, 2026
Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
Aug 6, 2026
XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of S…
Aug 6, 2026
Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations
Aug 6, 2026
User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposu…
Aug 6, 2026
Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products
Aug 6, 2026
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
Aug 6, 2026
Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover
Aug 6, 2026
Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
Aug 6, 2026
Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products
Aug 6, 2026
Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions
Aug 6, 2026
Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery
Aug 6, 2026
Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure
Aug 6, 2026
Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks
Aug 6, 2026
Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access
Aug 6, 2026
Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification
Jul 20, 2026
Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service…
Jul 6, 2026
Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification
Jul 6, 2026
Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation
Jul 4, 2026
Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure
Jul 4, 2026
Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager
Jun 26, 2026
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2025-5802 | Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery | MEDIUM | 0.25% | Sep 15, 2026 |
| CVE-2026-4103 | Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution | MEDIUM | 0.30% | Sep 14, 2026 |
| CVE-2026-3096 | Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft | MEDIUM | 0.29% | Sep 10, 2026 |
| CVE-2025-12737 | Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution | HIGH | 0.22% | Sep 3, 2026 |
| CVE-2026-3416 | Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads | HIGH | 0.36% | Sep 3, 2026 |
| CVE-2026-3418 | Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution | CRITICAL | 0.76% | Aug 6, 2026 |
| CVE-2026-3415 | XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service | HIGH | 0.49% | Aug 6, 2026 |
| CVE-2025-14561 | Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations | CRITICAL | 0.41% | Aug 6, 2026 |
| CVE-2025-6508 | User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requests | MEDIUM | 0.28% | Aug 6, 2026 |
| CVE-2024-6541 | Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products | MEDIUM | 0.34% | Aug 6, 2026 |
| CVE-2026-5430 KEV | Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover | CRITICAL | 0.59% | Aug 6, 2026 |
| CVE-2026-1728 | Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover | CRITICAL | 0.48% | Aug 6, 2026 |
| CVE-2025-15039 | Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products | CRITICAL | 0.67% | Aug 6, 2026 |
| CVE-2026-0637 | Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products | MEDIUM | 0.16% | Aug 6, 2026 |
| CVE-2025-13394 | Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions | MEDIUM | 0.14% | Aug 6, 2026 |
| CVE-2025-13736 | Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery | LOW | 0.27% | Aug 6, 2026 |
| CVE-2024-10302 | Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure | MEDIUM | 0.29% | Aug 6, 2026 |
| CVE-2024-6832 | Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks | HIGH | 0.41% | Aug 6, 2026 |
| CVE-2024-8995 | Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access | MEDIUM | 0.19% | Aug 6, 2026 |
| CVE-2026-2445 | Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification | MEDIUM | 0.25% | Jul 20, 2026 |
| CVE-2026-4249 | Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption | HIGH | 0.56% | Jul 6, 2026 |
| CVE-2025-8591 | Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification | MEDIUM | 0.25% | Jul 6, 2026 |
| CVE-2024-1248 | Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation | MEDIUM | 0.30% | Jul 4, 2026 |
| CVE-2025-13475 | Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure | HIGH | 0.27% | Jul 4, 2026 |
| CVE-2026-2053 | Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager | CRITICAL | 0.39% | Jun 26, 2026 |
Showing 1 to 25 of 69 CVEs