[ Vendor · 19 CVEs ]
WSO2
CVEs affecting WSO2 published in the last 30 days, plus any WSO2 CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2024-7478 | 21 Oct 2026 | CVSS 5.8 | WSO2 API ManagerWhen a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during… | |
| CVE-2025-0326 | 21 Oct 2026 | Not scored yet | WSO2 Identity ServerThe system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as… | |
| CVE-2024-5563 | 21 Oct 2026 | CVSS 4.8 | WSO2 Identity ServerDue to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This… | |
| CVE-2024-6423 | 21 Oct 2026 | CVSS 4.0 | WSO2 API ManagerThe product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it… | |
| CVE-2024-4989 | 21 Oct 2026 | CVSS 5.4 | WSO2 API ManagerThe callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation… | |
| CVE-2024-5139 | 21 Oct 2026 | CVSS 6.1 | WSO2 Enterprise IntegratorThe Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads… | |
| CVE-2024-2323 | 20 Oct 2026 | CVSS 4.8 | WSO2 Enterprise IntegratorThe RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled… | |
| CVE-2025-7203 | 19 Oct 2026 | CVSS 4.9 | WSO2 Universal GatewayThe Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore… | |
| CVE-2025-10149 | 19 Oct 2026 | CVSS 8.2 | WSO2 Identity Server as Key ManagerThe SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This… | |
| CVE-2025-13173 | 19 Oct 2026 | CVSS 6.5 | WSO2 API Control PlaneTokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This… | |
| CVE-2025-13591 | 19 Oct 2026 | CVSS 5.3 | WSO2 Identity ServerThe authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system… | |
| CVE-2025-6623 | 19 Oct 2026 | CVSS 4.3 | WSO2 API ManagerThe carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of… | |
| CVE-2025-7043 | 19 Oct 2026 | CVSS 5.4 | WSO2 API ManagerThe ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use… | |
| CVE-2024-4412 | 19 Oct 2026 | CVSS 2.7 | WSO2 Enterprise IntegratorThe software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This… | |
| CVE-2024-4457 | 18 Oct 2026 | CVSS 9.1 | WSO2 Enterprise IntegratorThe Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply… | |
| CVE-2024-8122 | 8 Oct 2026 | CVSS 5.9 | WSO2 Identity ServerThe WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA). This… | |
| CVE-2026-5430 | 6 Aug 2026 | CVSS 10.0 | WSO2 Multiple Products Path TraversalThe JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker… | Exploited |
| CVE-2022-29464 | 18 Apr 2022 | CVSS 9.8 | WSO2 Multiple Products Unrestrictive Upload of FileCertain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a… | Exploited |
| CVE-2022-29464 | 18 Apr 2022 | CVSS 9.8 | WSO2 Multiple Products Unrestrictive Upload of FileCertain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a… | Exploited |