Login Request a demo
WA
Product
WSO2 API Control Plane
by WSO2 · last CVE Oct 28, 2026
On CISA KEVExploited in the wild
44
CVEs
1
On KEV
10.0
Max CVSS
6
New 30D
Vulnerabilities44In the news3Timeline
Severity mix
Critical 9High 13Medium 21Low 1
Severity
All severities44Critical9High13Medium21Low1
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add WSO2 API Control Plane to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-5430
In wildKEV
10.0
22%
Aug 6
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
Affected: 4.5.0 before 4.5.0.58; 4.6.0 before 4.6.0.22
CVE-2026-1728
9.8
0%
Aug 6
Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover
Affected: 4.5.0 before 4.5.0.49; 4.6.0 before 4.6.0.13
CVE-2025-9312
9.8
0%
Nov 18
Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products
Affected: 4.5.0 before 4.5.0.22
CVE-2025-9152
9.8
1%
Oct 16
Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint
Affected: 4.5.0 before 4.5.0.20
CVE-2025-10611
9.8
1%
Oct 16
Potential Broken Access Control in Multiple WSO2 Products via System REST APIs
Affected: 4.5.0 before 4.5.0.29
CVE-2025-15039
9.4
1%
Aug 6
Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
Affected: 4.5.0 before 4.5.0.45; 4.6.0 before 4.6.0.9
CVE-2026-3418
9.1
1%
Aug 6
Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
Affected: 4.5.0 before 4.5.0.53; 4.6.0 before 4.6.0.17
CVE-2025-10713
9.1
0%
Nov 5
XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration
Affected: 4.5.0 before 4.5.0.27
CVE-2025-14561
9.0
0%
Aug 6
Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations
Affected: 4.5.0 before 4.5.0.42; 4.6.0 before 4.6.0.7
CVE-2025-8325
8.8
0%
May 11
Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations
Affected: 4.5.0 before 4.5.0.18
CVE-2025-6670
8.8
0%
Nov 18
Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services
Affected: 4.5.0 before 4.5.0.36; 4.6.0 before 4.6.0.1
CVE-2026-3415
8.7
0%
Aug 6
XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service
Affected: 4.5.0 before 4.5.0.54; 4.6.0 before 4.6.0.17
CVE-2026-4249
8.6
1%
Jul 6
Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption
Affected: 4.5.0 before 4.5.0.55; 4.6.0 before 4.6.0.19; 4.7.0 before 4.7.0.2
CVE-2025-12737
8.4
0%
Sep 3
Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution
Affected: 4.5.0 before 4.5.0.36; 4.6.0 before 4.6.0.1
CVE-2026-3416
7.5
0%
Sep 3
Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads
Affected: 4.5.0 before 4.5.0.53
CVE-2024-6832
7.5
0%
Aug 6
Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks
Affected: 4.5.0 before 4.5.0.40; 4.6.0 before 4.6.0.4; 4.6.0 before 4.6.0.5
CVE-2025-8154
7.5
0%
May 11
HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation
Affected: 4.5.0 before 4.5.0.21
CVE-2025-13590
7.2
1%
Feb 19
Authenticated arbitrary file upload via a System REST API requiring administrator permission.
Affected: 4.5.0 before 4.5.0.39; 4.6.0 before 4.6.0.3
CVE-2025-11093
7.2
0%
Nov 5
Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)
Affected: 4.5.0 before 4.5.0.29
CVE-2025-10907
7.2
1%
Nov 5
Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution
Affected: 4.5.0 before 4.5.0.29
CVE-2025-3125
7.2
1%
Nov 5
Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution
Affected: 4.5.0 before 4.5.0.2; 4.6.0 before 4.6.0.3
CVE-2025-5717
7.2
1%
Sep 23
Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service
Affected: 4.5.0 before 4.5.0.6
CVE-2025-13173
6.5
0%
Oct 19
Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination
Affected: 4.5.0 before 4.5.0.47; 4.6.0 before 4.6.0.13
CVE-2025-9804
6.5
1%
Oct 16
Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
Affected: 4.5.0 before 4.5.0.24
CVE-2026-4103
6.4
0%
Sep 14
Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution
Affected: 4.5.0 before 4.5.0.55; 4.6.0 before 4.6.0.19
CVE-2026-11854
New
6.1–Oct 28
Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products
Affected: 4.5.0 before 4.5.0.66; 4.6.0 before 4.6.0.30; 4.7.0 before 4.7.0.1
CVE-2026-2445
6.1
0%
Jul 20
Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification
Affected: 4.5.0 before 4.5.0.56; 4.6.0 before 4.6.0.20
CVE-2025-8591
6.1
0%
Jul 6
Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification
Affected: 4.5.0 before 4.5.0.44; 4.6.0 before 4.6.0.8
CVE-2025-10853
6.1
0%
Nov 5
Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding
Affected: 4.5.0 before 4.5.0.27
CVE-2025-5770
6.1
0%
Nov 5
Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products
Affected: 4.5.0 before 4.5.0.11
CVE-2024-10302
5.8
0%
Aug 6
Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure
Affected: 4.5.0 before 4.5.0.10
CVE-2025-7043
5.4
0%
Oct 19
Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption
Affected: 4.5.0 before 4.5.0.15
CVE-2025-13394
5.4
0%
Aug 6
Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions
Affected: 4.5.0 before 4.5.0.39; 4.6.0 before 4.6.0.3
CVE-2025-5802
5.3
0%
Sep 15
Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery
Affected: 4.5.0 before 4.5.0.56; 4.6.0 before 4.6.0.18
CVE-2025-5605
5.3
1%
Oct 24
Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure
Affected: 4.5.0 before 4.5.0.11
CVE-2024-8008
5.2
1%
Jun 2
Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation
Affected: 4.5.0 before 4.5.0.17
CVE-2025-7203
4.9
0%
Oct 19
Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials
Affected: 4.5.0 before 4.5.0.47; 4.6.0 before 4.6.0.15
CVE-2024-8995
4.9
0%
Aug 6
Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access
Affected: 4.5.0 before 4.5.0.56; 4.6.0 before 4.6.0.20
CVE-2025-5350
4.8
1%
Oct 24
SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products
Affected: 4.5.0 before 4.5.0.7
CVE-2025-4760
4.8
0%
Sep 23
Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher
Affected: 4.5.0 before 4.5.0.8
CVE-2026-3096
4.7
0%
Sep 10
Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft
Affected: 4.5.0 before 4.5.0.54; 4.6.0 before 4.6.0.18
CVE-2026-0637
4.4
0%
Aug 6
Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products
Affected: 4.5.0 before 4.5.0.50; 4.6.0 before 4.6.0.14
CVE-2025-6623
4.3
0%
Oct 19
Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection
Affected: 4.5.0 before 4.5.0.12
CVE-2026-3583
New
3.1–Oct 28
Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
Affected: 4.5.0 before 4.5.0.68; 4.6.0 before 4.6.0.30; 4.7.0 before 4.7.0.3
Showing 44