GE
Product
geoserver
On CISA KEVExploited in the wild
28
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 7Medium 14Low 0
Watch
Add geoserver to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-58360 In wildKEV | 9.8 | Nov 25 | GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature Affected: >= 2.26.0, < 2.26.2; < 2.25.6 |
| CVE-2024-36401 In wildKEV | 9.8 | Jul 1 | Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver Affected: >= 2.23.0, < 2.23.6; >= 2.24.0, < 2.24.4; >= 2.25.0, < 2.25.2; < 2.22.6 |
| CVE-2023-43795 | 9.8 | Oct 24 | WPS Server Side Request Forgery in GeoServer Affected: < 2.22.5; >= 2.23.0, < 2.23.2 |
| CVE-2023-35042 | 9.8 | Jun 12 | GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as… Affected: 2.0.0 and later |
| CVE-2023-25157 | 9.8 | Feb 21 | Unfiltered SQL Injection Vulnerabilities in Geoserver Affected: >= 2.22.0, < 2.22.2; < 2.21.4 |
| CVE-2025-30220 | 9.1 | Jun 10 | GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling Affected: >= 2.27.0, < 2.27.1; >= 2.26.0, < 2.26.3; < 2.25.7 |
| CVE-2024-34711 | 8.2 | Jun 10 | GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF) Affected: < 2.25.0 |
| CVE-2024-29198 | 8.2 | Jun 10 | GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost Affected: >= 2.0.0, < 2.24.4; >= 2.25.0, < 2.25.2 |
| CVE-2025-30145 | 7.5 | Jun 10 | GeoServer has an Infinite Loop Vulnerability in Jiffle process Affected: >= 2.26.0, < 2.26.3; < 2.25.7 |
| CVE-2024-38524 | 7.5 | Jun 10 | GWC Home Page communicate version and revision information Affected: >= 2.26.0, < 2.26.2; < 2.25.6 |
| CVE-2024-24749 | 7.5 | Jul 1 | Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat Affected: < 2.23.5; >= 2.24.0, < 2.24.3 |
| CVE-2023-51444 | 7.2 | Mar 20 | GeoServer arbitrary file upload vulnerability in REST Coverage Store API Affected: < 2.23.4; = 2.24.0 |
| CVE-2023-41877 | 7.2 | Mar 20 | GeoServer log file path traversal vulnerability Affected: <= 2.23.4 |
| CVE-2025-21621 | 6.1 | Nov 25 | GeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format Affected: < 2.25.0 |
| CVE-2024-23634 | 6.0 | Mar 20 | GeoServer arbitrary file renaming vulnerability in REST Coverage/Data Store API Affected: < 2.23.5; >= 2.24.0, < 2.24.2 |
| CVE-2025-27505 | 5.3 | Jun 10 | GeoServer Missing Authorization on REST API Index Affected: >= 2.26.0, < 2.26.3; < 2.25.6 |
| CVE-2024-35230 | 5.3 | Dec 16 | Welcome and About GeoServer pages communicate version and revision information Affected: >= 2.0.0, < 2.26.0 |
| CVE-2023-41339 | 5.3 | Oct 24 | Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer Affected: < 2.22.5; >= 2.23.0, < 2.23.2 |
| CVE-2024-40625 | 4.9 | Jun 10 | GeoServer Coverage REST API Allows Server Side Request Forgery Affected: < 2.26.0 |
| CVE-2024-34696 | 4.9 | Jul 1 | GeoServer's Server Status shows sensitive environmental variables and Java properties Affected: >= 2.10.0, < 2.24.4; >= 2.25.0, < 2.25.1 |
| CVE-2024-23821 | 4.8 | Mar 20 | GeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS) Affected: < 2.23.4; = 2.24.0 |
| CVE-2024-23819 | 4.8 | Mar 20 | GeoServer Stored Cross-Site Scripting (XSS) vulnerability in MapML HTML Page Affected: < 2.23.4; = 2.24.0 |
| CVE-2024-23818 | 4.8 | Mar 20 | GeoServer Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers Format Affected: < 2.23.3; = 2.24.0 |
| CVE-2024-23643 | 4.8 | Mar 20 | GeoServer Stored Cross-Site Scripting (XSS) vulnerability in GWC Seed Form Affected: < 2.23.2; = 2.24.0 |
| CVE-2024-23642 | 4.8 | Mar 20 | GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG Renderer Affected: < 2.23.4; = 2.24.0 |
| CVE-2024-23640 | 4.8 | Mar 20 | GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Style Publisher Affected: < 2.23.3 |
| CVE-2023-51445 | 4.8 | Mar 20 | GeoServer Stored Cross-Site Scripting (XSS) vulnerability in REST Resources API Affected: < 2.23.3 |
| CVE-2008-7227 | – | Sep 14 | PartialBufferOutputStream2 in GeoServer before 1.6.1 and 1.7.0-beta1 attempts to flush buffer contents even when it is handling an "in memory buffer," which prevents the reporting… Affected: through 1.6.0; 1.3.0; 1.3.0; 1.3.0; 1.3.0; 1.3.0; +20 more |
Showing 28