GE
Product
GeoServer
On CISA KEVExploited in the wild
18
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 9Medium 4Low 0
Watch
Add GeoServer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-27505 | 5.3 | Jun 10 | GeoServer Missing Authorization on REST API Index Affected: before 2.25.6; 2.26.0 before 2.26.3 |
| CVE-2024-35230 | 5.3 | Dec 16 | Welcome and About GeoServer pages communicate version and revision information Affected: 2.0.0 before 2.25.1 |
| CVE-2023-41339 | 5.3 | Oct 24 | Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer Affected: before 2.22.5; 2.23.0 before 2.23.2 |
| CVE-2024-40625 | 4.9 | Jun 10 | GeoServer Coverage REST API Allows Server Side Request Forgery Affected: before 2.26.0 |
Showing 4