GE
Product
GeoServer
On CISA KEVExploited in the wild
18
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 9Medium 4Low 0
Watch
Add GeoServer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-58360 In wildKEV | 9.8 | Nov 25 | GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature Affected: All versions, or not specified |
| CVE-2024-36401 In wildKEV | 9.8 | Jul 1 | Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver Affected: All versions, or not specified |
| CVE-2023-43795 | 9.8 | Oct 24 | WPS Server Side Request Forgery in GeoServer Affected: before 2.22.5; 2.23.0 before 2.23.2 |
| CVE-2023-25157 | 9.8 | Feb 21 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data Affected: before 2.18.7; 2.19.0 before 2.19.7; 2.20.0 before 2.20.7; 2.21.0 before 2.21.4; 2.22.0 before 2.22.2 |
| CVE-2025-30220 | 9.1 | Jun 10 | GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling Affected: before 2.25.7; 2.26.0 before 2.26.3; 2.27.0 |
| CVE-2025-58175 | 8.2 | Jun 18 | GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution Affected: before 2.26.4; 2.27.0 before 2.27.3 |
| CVE-2024-34711 | 8.2 | Jun 10 | GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF) Affected: before 2.25.0 |
| CVE-2024-29198 | 8.2 | Jun 10 | GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost Affected: 2.0.0 before 2.24.4; 2.25.0 before 2.25.2 |
| CVE-2025-30145 | 7.5 | Jun 10 | GeoServer has an Infinite Loop Vulnerability in Jiffle process Affected: before 2.25.7; 2.26.0 before 2.26.3 |
| CVE-2024-38524 | 7.5 | Jun 10 | GWC Home Page communicate version and revision information Affected: before 2.25.6; 2.26.0 before 2.26.2 |
| CVE-2021-40822 | 7.5 | May 2 | GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host Affected: through 2.18.5; 2.19.0 before 2.19.3 |
| CVE-2025-52465 | 7.2 | Jun 18 | GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page Affected: before 2.26.4; 2.27.0 before 2.27.3 |
| CVE-2025-27511 | 7.2 | Jun 18 | GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection Affected: before 2.27.0 |
| CVE-2022-24847 | 7.2 | Apr 13 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data Affected: before 2.19.6; 2.20.0 before 2.20.4 |
| CVE-2025-27505 | 5.3 | Jun 10 | GeoServer Missing Authorization on REST API Index Affected: before 2.25.6; 2.26.0 before 2.26.3 |
| CVE-2024-35230 | 5.3 | Dec 16 | Welcome and About GeoServer pages communicate version and revision information Affected: 2.0.0 before 2.25.1 |
| CVE-2023-41339 | 5.3 | Oct 24 | Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer Affected: before 2.22.5; 2.23.0 before 2.23.2 |
| CVE-2024-40625 | 4.9 | Jun 10 | GeoServer Coverage REST API Allows Server Side Request Forgery Affected: before 2.26.0 |
Showing 18