GE
Vendor
geoserver
34
CVEs
2
On KEV
0
New 30D
Products
GE9.8
geoserver
geoserver
27 CVEs2 on KEV0 new
GE8.8
GeoWebCache
GeoServer
2 CVEs0 on KEV0 new
OR8.2
org.geoserver.web:gs-web-app
geoserver
2 CVEs0 on KEV0 new
OR7.2
org.geoserver.extension:gs-db2
geoserver
1 CVEs0 on KEV0 new
OR8.2
org.geoserver:gs-main
geoserver
1 CVEs0 on KEV0 new
OR7.2
org.geoserver.web:gs-web-sec-core
geoserver
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-58175 | OR org.geoserver:gs-main geoserver | 8.2 | Jun 18 | GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution |
| CVE-2025-52465 | OR org.geoserver.web:gs-web-sec-core geoserver | 7.2 | Jun 18 | GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page |
| CVE-2025-27511 | OR org.geoserver.extension:gs-db2 geoserver | 7.2 | Jun 18 | GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection |
| CVE-2025-21621 | GE geoserver geoserver | 6.1 | Nov 25 | GeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format |
| CVE-2025-58360 In wildKEV | GE geoserver geoserver | 9.8 | Nov 25 | GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature |
| CVE-2025-30220 | GE geoserver geoserver | 9.1 | Jun 10 | GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling |
| CVE-2025-30145 | GE geoserver geoserver | 7.5 | Jun 10 | GeoServer has an Infinite Loop Vulnerability in Jiffle process |
| CVE-2025-27505 | GE geoserver geoserver | 5.3 | Jun 10 | GeoServer Missing Authorization on REST API Index |
| CVE-2024-40625 | GE geoserver geoserver | 4.9 | Jun 10 | GeoServer Coverage REST API Allows Server Side Request Forgery |
| CVE-2024-38524 | GE geoserver geoserver | 7.5 | Jun 10 | GWC Home Page communicate version and revision information |
| CVE-2024-34711 | GE geoserver geoserver | 8.2 | Jun 10 | GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF) |
| CVE-2024-29198 | GE geoserver geoserver | 8.2 | Jun 10 | GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost |
| CVE-2024-35230 | GE geoserver geoserver | 5.3 | Dec 16 | Welcome and About GeoServer pages communicate version and revision information |
| CVE-2024-36401 In wildKEV | GE geoserver geoserver | 9.8 | Jul 1 | Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver |
| CVE-2024-34696 | GE geoserver geoserver | 4.9 | Jul 1 | GeoServer's Server Status shows sensitive environmental variables and Java properties |
| CVE-2024-24749 | GE geoserver geoserver | 7.5 | Jul 1 | Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat |
| CVE-2024-23821 | GE geoserver geoserver | 4.8 | Mar 20 | GeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS) |
| CVE-2024-23819 | GE geoserver geoserver | 4.8 | Mar 20 | GeoServer Stored Cross-Site Scripting (XSS) vulnerability in MapML HTML Page |
| CVE-2024-23818 | GE geoserver geoserver | 4.8 | Mar 20 | GeoServer Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers Format |
| CVE-2024-23643 | GE geoserver geoserver | 4.8 | Mar 20 | GeoServer Stored Cross-Site Scripting (XSS) vulnerability in GWC Seed Form |
| CVE-2024-23642 | GE geoserver geoserver | 4.8 | Mar 20 | GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG Renderer |
| CVE-2024-23640 | GE geoserver geoserver | 4.8 | Mar 20 | GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Style Publisher |
| CVE-2024-23634 | GE geoserver geoserver | 6.0 | Mar 20 | GeoServer arbitrary file renaming vulnerability in REST Coverage/Data Store API |
| CVE-2023-51445 | GE geoserver geoserver | 4.8 | Mar 20 | GeoServer Stored Cross-Site Scripting (XSS) vulnerability in REST Resources API |
| CVE-2023-51444 | GE geoserver geoserver | 7.2 | Mar 20 | GeoServer arbitrary file upload vulnerability in REST Coverage Store API |
| CVE-2023-41877 | GE geoserver geoserver | 7.2 | Mar 20 | GeoServer log file path traversal vulnerability |
| CVE-2023-5786 | GE GeoWebCache GeoServer | 8.8 | Oct 26 | GeoServer GeoWebCache rest.html direct request |
| CVE-2023-43795 | GE geoserver geoserver | 9.8 | Oct 24 | WPS Server Side Request Forgery in GeoServer |
| CVE-2023-41339 | GE geoserver geoserver | 5.3 | Oct 24 | Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer |
| CVE-2023-35042 | GE Geoserver Geoserver | 9.8 | Jun 12 | GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as… |
| CVE-2022-24846 | GE Geowebcache Geoserver | 7.2 | Apr 14 | GeoWebCache is a tile caching server implemented in Java |
| CVE-2008-7227 | GE Geoserver Geoserver | – | Sep 14 | PartialBufferOutputStream2 in GeoServer before 1.6.1 and 1.7.0-beta1 attempts to flush buffer contents even when it is handling an "in memory buffer," which prevents the reporting… |