GE
Product
geoserver
On CISA KEVExploited in the wild
29
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 8Medium 14Low 0
Watch
Add geoserver to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-34711 | 8.2 | Jun 10 | GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF) Affected: < 2.25.0 |
| CVE-2024-29198 | 8.2 | Jun 10 | GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost Affected: >= 2.0.0, < 2.24.4; >= 2.25.0, < 2.25.2 |
| CVE-2025-30145 | 7.5 | Jun 10 | GeoServer has an Infinite Loop Vulnerability in Jiffle process Affected: >= 2.26.0, < 2.26.3; < 2.25.7 |
| CVE-2024-38524 | 7.5 | Jun 10 | GWC Home Page communicate version and revision information Affected: >= 2.26.0, < 2.26.2; < 2.25.6 |
| CVE-2024-24749 | 7.5 | Jul 1 | Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat Affected: < 2.23.5; >= 2.24.0, < 2.24.3 |
| CVE-2023-51444 | 7.2 | Mar 20 | GeoServer arbitrary file upload vulnerability in REST Coverage Store API Affected: < 2.23.4; = 2.24.0 |
| CVE-2023-41877 | 7.2 | Mar 20 | GeoServer log file path traversal vulnerability Affected: <= 2.23.4 |
| CVE-2022-24847 | 7.2 | Apr 13 | Improper Input Validation in GeoServer Affected: >= 2.20.0, < 2.20.4; < 2.19.6 |
Showing 8