Login Request a demo
OB
Product
Open Banking Iam
by Wso2 · last CVE Sep 3, 2026
On CISA KEVExploited in the wildRansomware-linked
33
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities33In the news0Timeline
Severity mix
Critical 7High 6Medium 18Low 2
Severity
All severities33Critical7High6Medium18Low2
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Open Banking Iam to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-29464
RansomwareIn wildKEV
9.8
100%
Apr 18
WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
Affected: 2.0.0
CVE-2025-9312
9.8
0%
Nov 18
Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products
Affected: 2.0.0
CVE-2025-10611
9.8
1%
Oct 16
Potential Broken Access Control in Multiple WSO2 Products via System REST APIs
Affected: 2.0.0
CVE-2024-6914
9.8
1%
May 22
Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover
Affected: 2.0.0
CVE-2025-15039
9.4
1%
Aug 6
Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
Affected: 2.0.0 before 2.0.0.425
CVE-2024-2374
9.1
0%
Apr 16
XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service
Affected: 2.0.0 before 2.0.0.348
CVE-2025-10713
9.1
0%
Nov 5
XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration
Affected: 2.0.0
CVE-2025-6670
8.8
0%
Nov 18
Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services
Affected: 2.0.0
CVE-2025-12737
8.4
0%
Sep 3
Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution
Affected: 2.0.0 before 2.0.0.418
CVE-2024-6832
7.5
0%
Aug 6
Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks
Affected: 2.0.0
CVE-2025-10907
7.2
1%
Nov 5
Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution
Affected: 2.0.0
CVE-2025-3125
7.2
1%
Nov 5
Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution
Affected: 2.0.0
CVE-2025-1862
7.2
1%
Sep 26
Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution
Affected: 2.0.0
CVE-2025-0663
6.8
0%
Sep 23
Potential cross-tenant account takeover vulnerability in Multiple WSO2 Products via Adaptive Authentication and Auto-Login
Affected: 2.0.0
CVE-2025-9804
6.5
1%
Oct 16
Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
Affected: 2.0.0
CVE-2024-7073
6.5
0%
Jun 2
Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services
Affected: 2.0.0
CVE-2025-8591
6.1
0%
Jul 6
Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification
Affected: 2.0.0 before 2.0.0.424
CVE-2025-10853
6.1
0%
Nov 5
Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding
Affected: 2.0.0
CVE-2024-10302
5.8
0%
Aug 6
Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure
Affected: 2.0.0
CVE-2025-13394
5.4
0%
Aug 6
Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions
Affected: 2.0.0 before 2.0.0.421
CVE-2024-7096
5.4
1%
May 30
Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw
Affected: 2.0.0
CVE-2024-1248
5.3
0%
Jul 4
Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation
Affected: 2.0.0 before 2.0.0.333
CVE-2025-5605
5.3
1%
Oct 24
Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure
Affected: 2.0.0
CVE-2025-1396
5.3
0%
Sep 26
Username Enumeration in Multiple WSO2 Products with Multi-Attribute Login Enabled
Affected: 2.0.0
CVE-2024-8008
5.2
1%
Jun 2
Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation
Affected: 2.0.0
CVE-2024-8995
4.9
0%
Aug 6
Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access
Affected: 2.0.0 before 2.0.0.389
CVE-2025-5350
4.8
1%
Oct 24
SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products
Affected: 2.0.0
CVE-2026-0637
4.4
0%
Aug 6
Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products
Affected: 2.0.0 before 2.0.0.426
CVE-2024-0391
4.3
0%
May 11
Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery
Affected: 2.0.0 before 2.0.0.318
CVE-2024-3511
4.3
0%
Jun 23
Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files
Affected: 2.0.0
CVE-2024-7097
4.3
1%
May 30
Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup
Affected: 2.0.0
CVE-2025-0672
3.8
0%
Sep 23
Authentication Bypass in Multiple WSO2 Products via Stale FIDO Credential Association
Affected: 2.0.0
CVE-2025-13736
3.7
0%
Aug 6
Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery
Affected: 2.0.0 before 2.0.0.420
Showing 33