Login Request a demo
GE
Product
geoserver
by geoserver · last CVE Nov 25, 2025
On CISA KEVExploited in the wild
29
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities29In the news1Timeline
Severity mix
Critical 6High 8Medium 14Low 0
Severity
All severities29Critical6High8Medium14Low0
Exploitation
On CISA KEV2Exploited in the wild2
Watch

Add geoserver to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-58360
In wildKEV
9.8
61%
Nov 25
GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
Affected: >= 2.26.0, < 2.26.2; < 2.25.6
CVE-2024-36401
In wildKEV
9.8
100%
Jul 1
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
Affected: >= 2.23.0, < 2.23.6; >= 2.24.0, < 2.24.4; >= 2.25.0, < 2.25.2; < 2.22.6
CVE-2023-43795
9.8
69%
Oct 24
WPS Server Side Request Forgery in GeoServer
Affected: < 2.22.5; >= 2.23.0, < 2.23.2
CVE-2023-35042
9.8
45%
Jun 12
GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as…
Affected: 2.0.0 and later
CVE-2023-25157
9.8
85%
Feb 21
Unfiltered SQL Injection Vulnerabilities in Geoserver
Affected: >= 2.22.0, < 2.22.2; < 2.21.4
CVE-2025-30220
9.1
42%
Jun 10
GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling
Affected: >= 2.27.0, < 2.27.1; >= 2.26.0, < 2.26.3; < 2.25.7
Showing 6