WA
Product
WSO2 API Manager
On CISA KEVExploited in the wild
77
CVEs
1
On KEV
10.0
Max CVSS
14
New 30D
Severity mix
Critical 14High 17Medium 43Low 3
Watch
Add WSO2 API Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-13736 | 3.7 | Aug 6 | Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery Affected: 3.1.0 before 3.1.0.351; 3.2.0 before 3.2.0.455; 4.0.0 before 4.0.0.375 |
| CVE-2026-3583 New | 3.1 | Oct 28 | Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows] Affected: 3.1.0 before 3.1.0.367; 3.2.0 before 3.2.0.475; 3.2.1 before 3.2.1.106; 4.0.0 before 4.0.0.394; 4.1.0 before 4.1.0.267; 4.2.0 before 4.2.0.207; +5 more |
| CVE-2024-4412 | 2.7 | Oct 19 | Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations Affected: 3.1.0 before 3.1.0.276; 3.2.0 before 3.2.0.366; 3.2.1 before 3.2.1.18; 4.0.0 before 4.0.0.307; 4.1.0 before 4.1.0.169; 4.2.0 before 4.2.0.108; +1 more |
Showing 3