AM
Product
Api Manager
On CISA KEVExploited in the wildRansomware-linked
95
CVEs
2
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 16High 20Medium 58Low 1
Watch
Add Api Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-15108 | 4.8 | Aug 16 | An issue was discovered in WSO2 API Manager 2.6.0 before WSO2-CARBON-PATCH-4.4.0-4457 Affected: through 2.6.0 |
| CVE-2017-14651 | 4.8 | Sep 21 | WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter Affected: 2.1.0 |
| CVE-2026-0637 | 4.4 | Aug 6 | Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Affected: 3.1.0 before 3.1.0.357; 3.2.0 before 3.2.0.465; 3.2.1 before 3.2.1.84; 4.1.0 before 4.1.0.249; 4.2.0 before 4.2.0.189; 4.3.0 before 4.3.0.100; +3 more |
| CVE-2024-6429 | 4.3 | Sep 23 | Content Spoofing in Multiple WSO2 Products via Error Message Injection Affected: 3.2.0; 3.2.1; 4.0.0; 4.1.0; 4.2.0; 4.3.0; +1 more |
| CVE-2024-3511 | 4.3 | Jun 23 | Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files Affected: 3.2.0; 3.2.1; 4.0.0; 4.1.0; 4.2.0; 4.3.0 |
| CVE-2024-3509 | 4.3 | Jun 2 | Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor Affected: 3.2.0; 3.2.1; 4.0.0; 4.1.0; 4.2.0; 4.3.0 |
| CVE-2024-7097 | 4.3 | May 30 | Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup Affected: 2.1.0; 2.2.0; 2.5.0; 2.6.0; 3.0.0; 3.1.0; +6 more |
| CVE-2019-6512 | 4.1 | May 14 | An issue was discovered in WSO2 API Manager 2.6.0 Affected: 2.6.0 |