Vulnerabilities in WSO2
131 resultsCVE-2026-5430CRITICALAuthentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account TakeoverEPSS 22.4%KEVCVE-2024-7074MEDIUMAuthenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code ExecutionEPSS 17.7%CVE-2025-2905CRITICALAn XML External Entity (XXE) vulnerability in Multiple WSO2 ProductsEPSS 1.3%CVE-2026-78674HIGHRemote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command ExecutionEPSS 1.0%CVE-2025-3125MEDIUMAuthenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code ExecutionEPSS 0.9%CVE-2025-5605MEDIUMAuthentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information DisclosureEPSS 0.9%CVE-2025-10611CRITICALPotential Broken Access Control in Multiple WSO2 Products via System REST APIsEPSS 0.8%CVE-2025-13590CRITICALAuthenticated arbitrary file upload via a System REST API requiring administrator permission.EPSS 0.8%CVE-2026-3418CRITICALArbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code ExecutionEPSS 0.8%CVE-2024-6914CRITICALIncorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account TakeoverEPSS 0.8%CVE-2024-7096MEDIUMPrivilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic FlawEPSS 0.7%CVE-2025-9152CRITICALImproper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR EndpointEPSS 0.7%CVE-2022-4520LOWWSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scriptingEPSS 0.7%CVE-2025-5717MEDIUMAuthenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin ServiceEPSS 0.7%CVE-2025-12107HIGHServer-Side Template Injection via Velocity Template Engine in Multiple WSO2 Products Allows Remote Code ExecutionEPSS 0.7%CVE-2025-15039CRITICALAccount Takeover via Conditional Authentication Script Logic in Multiple WSO2 ProductsEPSS 0.7%CVE-2024-7097MEDIUMIncorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User SignupEPSS 0.7%CVE-2022-4521LOWWSO2 carbon-registry Request Parameter cross site scriptingEPSS 0.6%CVE-2025-5350MEDIUMSSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 ProductsEPSS 0.6%CVE-2025-10907HIGHAuthenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code ExecutionEPSS 0.6%