Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Critical10.0WSO2 Multiple Products Path Traversal VulnerabilityKEVEPSS 0.6%Aug 6, 2026
- High7.2Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be trigge…EPSS 0.4%May 11, 2026
- High8.6The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth.EPSS 0.3%May 11, 2026
- High8.8The software fails to enforce role-based access controls for certain Gateway API invocations.EPSS 0.2%May 11, 2026
- High7.5In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to…EPSS 0.2%May 11, 2026
- High7.3Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass Key methods.EPSS 0.2%May 11, 2026
- Medium6.1The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection.EPSS 0.2%Apr 16, 2026
- High8.1When the "Silent Just-In-Time Provisioning" feature is enabled for a federated identity provider (IDP) there is a risk that a local user store user's information may b…Feb 24, 2026
- Critical9.8WSO2 Multiple Products Unrestrictive Upload of File VulnerabilityKEVEPSS 100.0%Apr 18, 2022
9 records · page 1 of 1
PreviousNext