Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- UnknownThe Management Console fails to properly validate input related to the configuration of JDBC user stores.Open the advisoryOct 18, 2026
- Critical10.0WSO2 Multiple Products Path Traversal VulnerabilityPatch nowKEVEPSS 0.59%Aug 6, 2026
- High7.2Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be trigge…Check if you run itEPSS 0.37%May 11, 2026
- High8.6The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth.Check if you run itEPSS 0.32%May 11, 2026
- High8.8The software fails to enforce role-based access controls for certain Gateway API invocations.Check if you run itEPSS 0.17%May 11, 2026
- High7.5In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to…Check if you run itEPSS 0.19%May 11, 2026
- High7.3Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass Key methods.Check if you run itEPSS 0.23%May 11, 2026
- Medium4.3The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered user accounts.Check if you run itEPSS 0.18%May 11, 2026
- Medium6.1The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a lack of proper output encoding.Check if you run itEPSS 0.17%Apr 29, 2026
- Medium5.4Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server.Check if you run itEPSS 0.18%Apr 16, 2026
- Medium6.1The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection.Check if you run itEPSS 0.23%Apr 16, 2026
- High7.5The component accepts XML input through the publisher without disabling external entity resolution.Check if you run itEPSS 0.27%Apr 16, 2026
- Medium5.4The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding.Check if you run itEPSS 0.19%Apr 16, 2026
- Medium6.1The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response.Check if you run itEPSS 0.24%Apr 16, 2026
- Critical9.1The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities.Check if you run itEPSS 0.38%Apr 16, 2026
- High8.1When the "Silent Just-In-Time Provisioning" feature is enabled for a federated identity provider (IDP) there is a risk that a local user store user's information may b…Check if you run itEPSS 0.27%Feb 24, 2026
- UnknownWSO2 api_control_plane Authentication Bypass by SpoofingPatch nowKEVEPSS 0.85%Nov 28, 2025
- Medium5.4An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authenticatioCheck if you run itEPSS 0.23%Jun 2, 2025
- Medium5.2A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connectCheck this weekEPSS 53.00%Jun 2, 2025
- Medium4.3A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich Text Editor within theCheck if you run itEPSS 0.20%Jun 2, 2025
- Medium6.8An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services.Check this weekEPSS 17.19%Jun 2, 2025
- Medium6.5A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services.Check if you run itEPSS 0.22%Jun 2, 2025
- Medium4.2A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services.Check this weekEPSS 71.00%May 30, 2025
- Medium6.1A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoint of multiple WSO2 products due to missing output encoding of user-supplied input.Check this weekEPSS 25.00%May 22, 2025
- Medium5.8An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentication to be bypassed when an invalid objCheck this weekEPSS 32.00%May 22, 2025
33 records · page 1 of 2
PreviousNext