Login Request a demo
GE
Product
GeoServer
by OSGeo · last CVE Jun 18, 2026
On CISA KEVExploited in the wild
18
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities18In the news1Timeline
Severity mix
Critical 5High 9Medium 4Low 0
Severity
All severities18Critical5High9Medium4Low0
Exploitation
On CISA KEV2Exploited in the wild2
Watch

Add GeoServer to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-58360
In wildKEV
9.8
61%
Nov 25
GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
Affected: All versions, or not specified
CVE-2024-36401
In wildKEV
9.8
100%
Jul 1
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
Affected: All versions, or not specified
CVE-2023-43795
9.8
69%
Oct 24
WPS Server Side Request Forgery in GeoServer
Affected: before 2.22.5; 2.23.0 before 2.23.2
CVE-2023-25157
9.8
85%
Feb 21
Unfiltered SQL Injection Vulnerabilities in Geoserver
Affected: before 2.18.7; 2.19.0 before 2.19.7; 2.20.0 before 2.20.7; 2.21.0 before 2.21.4; 2.22.0 before 2.22.2
CVE-2025-30220
9.1
42%
Jun 10
GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling
Affected: before 2.25.7; 2.26.0 before 2.26.3; 2.27.0
Showing 5