Login Request a demo
WS
Vendor
WSO2
164 products with CVEs on record
1,098
CVEs
19
On KEV
109
New 30D
Products
WI
WSO2 Identity Server
WSO2
9.8
74 CVEs0 on KEV17 new
WA
WSO2 API Manager
WSO2
10.0
77 CVEs1 on KEV14 new
WI
WSO2 Identity Server as Key Manager
WSO2
9.8
47 CVEs0 on KEV10 new
WO
WSO2 Open Banking IAM
WSO2
9.8
45 CVEs0 on KEV10 new
WO
WSO2 Open Banking AM
WSO2
9.8
40 CVEs0 on KEV9 new
WA
WSO2 API Control Plane
WSO2
10.0
44 CVEs1 on KEV6 new
WU
WSO2 Universal Gateway
WSO2
10.0
36 CVEs1 on KEV5 new
WT
WSO2 Traffic Manager
WSO2
10.0
36 CVEs1 on KEV4 new
WE
WSO2 Enterprise Integrator
WSO2
9.1
25 CVEs0 on KEV4 new
WC
WSO2 Carbon OAuth
WSO2
7.4
6 CVEs0 on KEV4 new
WC
WSO2 Carbon User Manager Kernel
WSO2
9.1
4 CVEs0 on KEV2 new
WC
WSO2 Carbon Identity Application Authentication Framework
WSO2
9.4
4 CVEs0 on KEV1 new
BP
Business Process Server
WSO2
8.8
3 CVEs0 on KEV1 new
EO
Email OTP Authenticator
WSO2
5.3
3 CVEs0 on KEV1 new
WC
WSO2 Carbon Identity User Store Configuration UI
WSO2
5.4
3 CVEs0 on KEV1 new
WC
WSO2 Carbon Abstract OTP Authenticator
WSO2
5.3
2 CVEs0 on KEV1 new
WC
WSO2 Carbon Identity Recovery Management
WSO2
5.8
2 CVEs0 on KEV1 new
EI
Enterprise Integrator (BPS profile)
WSO2
8.8
1 CVEs0 on KEV1 new
FK
Forgerock Key Manager Component
WSO2
5.4
1 CVEs0 on KEV1 new
SS
SAML2 SSO Authenticator UI Bundle
WSO2
8.3
1 CVEs0 on KEV1 new
WC
WSO2 Carbon Event Publisher UI
WSO2
4.3
1 CVEs0 on KEV1 new
WC
WSO2 Carbon Event Receiver UI
WSO2
4.3
1 CVEs0 on KEV1 new
WC
WSO2 Carbon Identity API Server Configs V1
WSO2
4.9
1 CVEs0 on KEV1 new
WC
WSO2 Carbon Identity Application
WSO2
4.0
1 CVEs0 on KEV1 new
WC
WSO2 Carbon Identity Core
WSO2
4.0
1 CVEs0 on KEV1 new
WC
WSO2 Carbon Identity Oauth
WSO2
4.0
1 CVEs0 on KEV1 new
WC
WSO2 Carbon Identity User Store
WSO2
2.7
1 CVEs0 on KEV1 new
WC
WSO2 Carbon Identity User Store Configuration
WSO2
2.7
1 CVEs0 on KEV1 new
WC
WSO2 Carbon Logging Services
WSO2
4.9
1 CVEs0 on KEV1 new
WC
WSO2 Carbon SCIM 2.0 Common Component
WSO2
8.2
1 CVEs0 on KEV1 new
WC
WSO2 Carbon SCIM Common Component
WSO2
8.2
1 CVEs0 on KEV1 new
WC
WSO2 Carbon Secured HTTP Log4j2 Appender
WSO2
4.9
1 CVEs0 on KEV1 new
WC
WSO2 Carbon UI
WSO2
8.3
1 CVEs0 on KEV1 new
WC
WSO2 Carbon User Management UI
WSO2
6.1
1 CVEs0 on KEV1 new
WC
WSO2 Carborn Identity Handler
WSO2
5.8
1 CVEs0 on KEV1 new
AM
Api Manager
Wso2
10.0
95 CVEs2 on KEV0 new
MP
Multiple Products
WSO2
10.0
2 CVEs2 on KEV0 new
IS
Identity Server
WSO2
9.8
83 CVEs1 on KEV0 new
IS
Identity Server AS Key Manager
Wso2
9.8
52 CVEs1 on KEV0 new
EI
Enterprise Integrator
Wso2
9.8
33 CVEs1 on KEV0 new
OB
Open Banking Iam
Wso2
9.8
33 CVEs1 on KEV0 new
AC
Api Control Plane
Wso2
10.0
31 CVEs1 on KEV0 new
TM
Traffic Manager
Wso2
10.0
27 CVEs1 on KEV0 new
OB
Open Banking AM
Wso2
9.8
26 CVEs1 on KEV0 new
UG
Universal Gateway
Wso2
10.0
26 CVEs1 on KEV0 new
IS
Identity Server Analytics
Wso2
9.8
11 CVEs1 on KEV0 new
OB
Open Banking KM
Wso2
9.8
9 CVEs1 on KEV0 new
WC
WSO2 Carbon API Manager Rest API Utility
WSO2
10.0
4 CVEs1 on KEV0 new
AM
API Manager Analytics
WSO2
8.8
11 CVEs0 on KEV0 new
AM
Api Microgateway
Wso2
9.1
11 CVEs0 on KEV0 new
WO
WSO2 Open banking KM
WSO2
9.8
8 CVEs0 on KEV0 new
DA
Data Analytics Server
Wso2
8.8
7 CVEs0 on KEV0 new
IS
Iot Server
Wso2
8.8
7 CVEs0 on KEV0 new
WM
WSO2 Micro integrator
WSO2
9.1
6 CVEs0 on KEV0 new
MI
Micro Integrator
Wso2
7.5
5 CVEs0 on KEV0 new
WC
WSO2 Carbon API Management Implementation
WSO2
9.1
5 CVEs0 on KEV0 new
DS
Dashboard Server
Wso2
6.1
4 CVEs0 on KEV0 new
WE
WSO2 Enterprise Mobility Manager
WSO2
6.8
4 CVEs0 on KEV0 new
CA
Carbon
Wso2
6.1
3 CVEs0 on KEV0 new
OR
org.wso2.carbon:org.wso2.carbon.base
WSO2
7.2
3 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-78674
New
BP
Business Process Server
WSO2
8.8–Oct 28Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution
CVE-2026-6647
New
WI
WSO2 Identity Server
WSO2
7.4–Oct 28Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events
CVE-2026-3583
New
WI
WSO2 Identity Server as Key Manager
WSO2
3.1–Oct 28Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
CVE-2026-11854
New
WI
WSO2 Identity Server
WSO2
6.1–Oct 28Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products
CVE-2025-14260
New
WO
WSO2 Open Banking AM
WSO2
8.3–Oct 28Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources
CVE-2024-6423
WI
WSO2 Identity Server as Key Manager
WSO2
4.0
0%
Oct 21Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage
CVE-2025-0326
WI
WSO2 Identity Server
WSO2
–
0%
Oct 21Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access
CVE-2024-7478
WO
WSO2 Open Banking AM
WSO2
5.8
0%
Oct 21Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery
CVE-2024-5563
WI
WSO2 Identity Server
WSO2
4.8
0%
Oct 21Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks
CVE-2024-4989
WA
WSO2 API Manager
WSO2
5.4
0%
Oct 21Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks
CVE-2024-5139
WO
WSO2 Open Banking AM
WSO2
6.1
0%
Oct 21Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection
CVE-2024-2323
WA
WSO2 API Manager
WSO2
4.8
0%
Oct 20Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery
CVE-2024-4412
WC
WSO2 Carbon Identity Recovery Management
WSO2
2.7
0%
Oct 19Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations
CVE-2025-13173
WI
WSO2 Identity Server as Key Manager
WSO2
6.5
0%
Oct 19Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination
CVE-2025-13591
WC
WSO2 Carbon Abstract OTP Authenticator
WSO2
5.3
0%
Oct 19Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery
CVE-2025-10149
WI
WSO2 Identity Server as Key Manager
WSO2
8.2
0%
Oct 19Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover
CVE-2025-7203
WI
WSO2 Identity Server
WSO2
4.9
0%
Oct 19Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials
CVE-2025-7043
WA
WSO2 API Manager
WSO2
5.4
0%
Oct 19Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption
CVE-2025-6623
WT
WSO2 Traffic Manager
WSO2
4.3
0%
Oct 19Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection
CVE-2024-4457
WO
WSO2 Open Banking AM
WSO2
9.1
0%
Oct 18Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution
CVE-2024-8122
WI
WSO2 Identity Server
WSO2
5.9
0%
Oct 8Potential brute force vulnerability due to non-expiring SMS OTPs
CVE-2025-13166
WI
WSO2 Identity Server
WSO2
3.7
0%
Sep 15Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery
CVE-2025-5802
WO
WSO2 Open Banking AM
WSO2
5.3
0%
Sep 15Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery
CVE-2026-19515
WI
WSO2 Integrator: MI for Visual Studio Code
WSO2
7.0
0%
Sep 15OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution
CVE-2026-4103
WA
WSO2 API Manager
WSO2
6.4
0%
Sep 14Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution
CVE-2026-3096
WA
WSO2 API Manager
WSO2
4.7
0%
Sep 10Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft
CVE-2025-12737
WI
WSO2 Identity Server
WSO2
8.4
0%
Sep 3Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution
CVE-2026-3416
WA
WSO2 API Manager
WSO2
7.5
0%
Sep 3Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads
CVE-2026-3418
WC
WSO2 Carbon API Management Implementation
WSO2
9.1
1%
Aug 6Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
CVE-2026-3415
WC
WSO2 Carbon API Management Implementation
WSO2
8.7
0%
Aug 6XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service
CVE-2025-14561
WA
WSO2 API Manager
WSO2
9.0
0%
Aug 6Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations
CVE-2025-12317
WE
WSO2 Enterprise Integrator
WSO2
5.0
0%
Aug 6Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges
CVE-2025-6508
WA
WSO2 API Manager
WSO2
4.3
0%
Aug 6User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requests
CVE-2024-6541
WM
WSO2 Micro Integrator
WSO2
6.8
0%
Aug 6Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products
CVE-2026-5430
In wildKEV
WC
WSO2 Carbon API Manager Rest API Utility
WSO2
10.0
22%
Aug 6Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
CVE-2026-1728
WC
WSO2 Carbon API Manager Rest API Utility
WSO2
9.8
0%
Aug 6Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover
CVE-2025-15039
WA
WSO2 API Manager
WSO2
9.4
1%
Aug 6Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
CVE-2026-0637
WA
WSO2 API Manager
WSO2
4.4
0%
Aug 6Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products
CVE-2025-13394
WA
WSO2 API Manager
WSO2
5.4
0%
Aug 6Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions
CVE-2025-13909
EO
Email OTP Authenticator
WSO2
4.3
0%
Aug 6Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure
CVE-2025-12627
WC
WSO2 Carbon OAuth
WSO2
2.4
0%
Aug 6Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions
CVE-2025-14779
WC
WSO2 Carbon Identity API Server Secret Management V1
WSO2
3.8
0%
Aug 6Improper Access Control via Secret Type Management API in WSO2 Identity Server
CVE-2025-11850
WI
WSO2 Identity Server
WSO2
4.3
0%
Aug 6Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]
CVE-2025-13736
WO
WSO2 Open Banking IAM
WSO2
3.7
0%
Aug 6Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery
CVE-2024-10302
WT
WSO2 Traffic Manager
WSO2
5.8
0%
Aug 6Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure
CVE-2024-6832
WA
WSO2 API Manager
WSO2
7.5
0%
Aug 6Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks
CVE-2024-8995
WO
WSO2 Open Banking AM
WSO2
4.9
0%
Aug 6Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access
CVE-2026-2445
WA
WSO2 API Control Plane
WSO2
6.1
0%
Jul 20Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification
CVE-2026-4249
WA
WSO2 API Manager
WSO2
8.6
1%
Jul 6Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption
CVE-2025-8591
WA
WSO2 API Manager
WSO2
6.1
0%
Jul 6Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification
CVE-2024-1248
WO
WSO2 Open Banking IAM
WSO2
5.3
0%
Jul 4Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation
CVE-2025-13475
WI
WSO2 Identity Server
WSO2
7.3
0%
Jul 4Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure
CVE-2026-2053
WA
WSO2 API Manager
WSO2
10.0
0%
Jun 26Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager
CVE-2025-10470
WI
WSO2 Identity Server
WSO2
8.6
0%
May 11Denial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability
CVE-2025-9973
WI
WSO2 Identity Server
WSO2
7.2
0%
May 11Authorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account Takeover
CVE-2025-8325
WU
WSO2 Universal Gateway
WSO2
8.8
0%
May 11Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations
CVE-2025-8154
WA
WSO2 API Manager
WSO2
7.5
0%
May 11HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation
CVE-2025-10908
WC
WSO2 Carbon MagicLink Authenticator Module
WSO2
7.3
0%
May 11Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access
CVE-2024-0391
WI
WSO2 Identity Server as Key Manager
WSO2
4.3
0%
May 11Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery
CVE-2025-10503
WI
WSO2 Identity Server
WSO2
6.1
0%
Apr 29Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity Server