Wso2 Api_manager
83 CVEs affecting Wso2 Api_manager. Latest disclosed: 2026-07-06. Critical: 12, High: 11.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9312 | Critical | 9.8 | 2025-11-18 | A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 p… |
CVE-2025-9152 | Critical | 9.8 | 2025-10-16 | An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations D… |
CVE-2025-10611 | Critical | 9.8 | 2025-10-16 | Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed… |
CVE-2024-6914 | Critical | 9.8 | 2025-05-22 | An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A ma… |
CVE-2022-29464 | Critical | 9.8 | 2022-04-18 | Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposit… |
CVE-2020-13226 | Critical | 9.8 | 2020-05-20 | WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intra… |
CVE-2025-9804 | Critical | 9.6 | 2025-10-16 | An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services an… |
CVE-2025-13590 | Critical | 9.1 | 2026-02-19 | A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Succes… |
CVE-2025-2905 | Critical | 9.1 | 2025-05-05 | Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resol… |
CVE-2021-42646 | Critical | 9.1 | 2022-05-11 | XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2.6.0, 3.0.0, 3.1.0… |
CVE-2020-24590 | Critical | 9.1 | 2020-08-21 | The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks. |
CVE-2020-24589 | Critical | 9.1 | 2020-08-21 | The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks. |
CVE-2025-6670 | High | 8.8 | 2025-11-18 | A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within a… |
CVE-2020-24705 | High | 8.8 | 2020-08-27 | An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim s… |
CVE-2020-24703 | High | 8.8 | 2020-08-27 | An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim s… |
CVE-2026-4249 | High | 8.6 | 2026-07-06 | The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and cont… |
CVE-2023-6837 | High | 8.5 | 2023-12-15 | Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerability to have any imp… |
CVE-2025-11093 | High | 8.4 | 2025-11-05 | An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engine… |
CVE-2025-10907 | High | 8.4 | 2025-11-05 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin servic… |
CVE-2026-2053 | High | 8.3 | 2026-06-26 | The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within t… |