Login Request a demo
GE
Product
GeoServer
by OSGeo · last CVE Jun 18, 2026
On CISA KEVExploited in the wild
18
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities18In the news1Timeline
Severity mix
Critical 5High 9Medium 4Low 0
Severity
All severities18Critical5High9Medium4Low0
Exploitation
On CISA KEV2Exploited in the wild2
Watch

Add GeoServer to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-58360
In wildKEV
9.8
61%
Nov 25
GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
Affected: All versions, or not specified
CVE-2024-36401
In wildKEV
9.8
100%
Jul 1
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
Affected: All versions, or not specified
Showing 2