Wso2 - vulnerabilities (CVEs)

172 CVEs in 172 products, 21 in the last 30 days, newest from 2026-10-28.

Products

• Api Manager - 95 CVEs
• Identity Server - 83 CVEs
• Identity Server As Key Manager - 52 CVEs
• Wso2 Api Manager - 43 CVEs
• Wso2 Identity Server - 42 CVEs
• Enterprise Integrator - 33 CVEs
• Open Banking Iam - 33 CVEs
• Api Control Plane - 31 CVEs
• Wso2 Api Control Plane - 31 CVEs
• Traffic Manager - 27 CVEs
• Open Banking Am - 26 CVEs
• Universal Gateway - 26 CVEs
• Wso2 Universal Gateway - 26 CVEs
• Wso2 Identity Server As Key Manager - 25 CVEs
• Wso2 Traffic Manager - 25 CVEs
• Wso2 Open Banking Iam - 24 CVEs
• Wso2 Open Banking Am - 21 CVEs
• Wso2 Enterprise Integrator - 14 CVEs
• Api Manager Analytics - 11 CVEs
• Api Microgateway - 11 CVEs
• Identity Server Analytics - 11 CVEs
• Open Banking Km - 9 CVEs
• Data Analytics Server - 7 CVEs
• Iot Server - 7 CVEs
• Wso2 Open Banking Km - 6 CVEs
• Micro Integrator - 5 CVEs
• Wso2 Carbon Api Management Implementation - 5 CVEs
• Wso2 Carbon Oauth - 5 CVEs
• Dashboard Server - 4 CVEs
• Wso2 Enterprise Mobility Manager - 4 CVEs
• Wso2 Micro Integrator - 4 CVEs
• Business Process Server - 3 CVEs
• Carbon - 3 CVEs
• Email Otp Authenticator - 3 CVEs
• Wso2 Carbon Api Manager Rest Api Utility - 3 CVEs
• Wso2 Carbon Identity Application Authentication Framework - 3 CVEs
• Wso2 Carbon Magiclink Authenticator Module - 3 CVEs
• Wso2 Enterprise Service Bus - 3 CVEs
• Wso2 Is As Key Manager - 3 CVEs
• Application Server - 2 CVEs
• Business Rules Server - 2 CVEs
• Carbon-registry - 2 CVEs
• Complex Event Processor - 2 CVEs
• Data Services Server - 2 CVEs
• Enterprise Mobility Manager - 2 CVEs
• Enterprise Service Bus - 2 CVEs
• Machine Learner - 2 CVEs
• Message Broker - 2 CVEs
• Org.wso2.carbon Org.wso2.carbon.ui - 2 CVEs
• Org.wso2.carbonorg.wso2.carbon.base - 2 CVEs
• Org.wso2.carbonorg.wso2.carbon.server.admin - 2 CVEs
• Wso2 Api Manager Analytics - 2 CVEs
• Wso2 Api Microgateway - 2 CVEs
• Wso2 Carbon Abstract Otp Authenticator - 2 CVEs
• Wso2 Carbon Api Gateway - 2 CVEs
• Wso2 Carbon Identity User Store Configuration Ui - 2 CVEs
• Wso2 Carbon Registry Resources Ui - 2 CVEs
• Wso2 Carbon User Manager Kernel - 2 CVEs
• Wso2 Data Analytics Server - 2 CVEs
• Wso2 Identity Server Analytics - 2 CVEs
• App Manager - 1 CVEs
• Carbon Identity Application Authentication Endpoint - 1 CVEs
• Carbon Identity Application Authentication Framework - 1 CVEs
• Client Attestation Filter - 1 CVEs
• Conditional Authentication User And Roles Related Functions - 1 CVEs
• Enablement Server For Java - 1 CVEs
• Enterprise Integrator Bps Profile - 1 CVEs
• Forgerock Key Manager Component - 1 CVEs
• Governance Registry - 1 CVEs
• Org.apache.synapse Synapse-core - 1 CVEs
• Org.apache.synapse Synapse-extensions - 1 CVEs
• Org.apache.ws.commons.axiom.wso2 Axiom - 1 CVEs
• Org.jaggeryjs Org.jaggeryjs.jaggery.app.mgt - 1 CVEs
• Org.wso2.carbon.apimgt Org.wso2.carbon.apimgt.impl - 1 CVEs
• Org.wso2.carbon.apimgtorg.wso2.carbon.apimgt.rest.api.util - 1 CVEs
• Org.wso2.carbon.commons Org.wso2.carbon.application.upload - 1 CVEs
• Org.wso2.carbon.deployment Org.wso2.carbon.module.mgt - 1 CVEs
• Org.wso2.carbon.deployment Org.wso2.carbon.webapp.mgt - 1 CVEs
• Org.wso2.carbon.event-processing Org.wso2.carbon.event.simulator.core - 1 CVEs
• Org.wso2.carbon.extension.identity.authenticator.outbound.totporg.wso2.carbon.extension.identity.authenticator.totp.connector - 1 CVEs
• Org.wso2.carbon.governance Org.wso2.carbon.governance.wsdltool.ui - 1 CVEs
• Org.wso2.carbon.identity.auth.restorg.wso2.carbon.identity.auth.service - 1 CVEs
• Org.wso2.carbon.identity.auth.restorg.wso2.carbon.identity.auth.valve - 1 CVEs
• Org.wso2.carbon.identity.auth.service - 1 CVEs
• Org.wso2.carbon.identity.frameworkorg.wso2.carbon.identity.application.mgt - 1 CVEs
• Org.wso2.carbon.identity.inbound.auth.oauth2 Org.wso2.carbon.identity.oauth.ui - 1 CVEs
• Org.wso2.carbon.identity.workflow.userorg.wso2.carbon.user.mgt.workflow - 1 CVEs
• Org.wso2.carbon.mediation Org.wso2.carbon.localentry - 1 CVEs
• Org.wso2.carbon.mediation Org.wso2.carbon.mediation.library - 1 CVEs
• Org.wso2.carbon.registry Org.wso2.carbon.registry.info.ui - 1 CVEs
• Org.wso2.carbon.registry Org.wso2.carbon.registry.resource.ui - 1 CVEs
• Org.wso2.carbon Org.wso2.carbon.base - 1 CVEs
• Org.wso2.carbon Org.wso2.carbon.utils - 1 CVEs
• Org.wso2.carbonorg.wso2.carbon.ui - 1 CVEs
• Saml2 Sso Authenticator Ui Bundle - 1 CVEs
• Siddhi Extension Evaluate Scripts - 1 CVEs
• Storage Server - 1 CVEs
• Transport-http - 1 CVEs
• Wso2-synapse - 1 CVEs
• Wso2 Api Manager Publisher Rest Api V4 - 1 CVEs
• Wso2 Carbon Api Management Api - 1 CVEs
• Wso2 Carbon Api Manager Rest Api Common Functions - 1 CVEs
• Wso2 Carbon Authenticator Library For Emailotp - 1 CVEs
• Wso2 Carbon Command Mediator Ui - 1 CVEs
• Wso2 Carbon Component Andes Event Ui - 1 CVEs
• Wso2 Carbon Component Andes Ui1 - 1 CVEs
• Wso2 Carbon Email Verification Ui - 1 CVEs
• Wso2 Carbon Endpoint Editor Ui - 1 CVEs
• Wso2 Carbon Event Publisher Core - 1 CVEs
• Wso2 Carbon Event Publisher Ui - 1 CVEs
• Wso2 Carbon Event Receiver Ui - 1 CVEs
• Wso2 Carbon Event Simulator Ui - 1 CVEs
• Wso2 Carbon Eventing Ui - 1 CVEs
• Wso2 Carbon Execution Manager Ui - 1 CVEs
• Wso2 Carbon Governance - 1 CVEs
• Wso2 Carbon Governance Custom Lifecycle Checklist Ui - 1 CVEs
• Wso2 Carbon Governance Generic Artifact User Interface - 1 CVEs
• Wso2 Carbon Governance Life Cycles User Interface - 1 CVEs
• Wso2 Carbon Governance Wsdl Tool Ui - 1 CVEs
• Wso2 Carbon Hl7 Business Messaging Store Ui - 1 CVEs
• Wso2 Carbon Humantask Ui - 1 CVEs
• Wso2 Carbon Identity Api Server Configs V1 - 1 CVEs
• Wso2 Carbon Identity Api Server Secret Management Common - 1 CVEs
• Wso2 Carbon Identity Api Server Secret Management V1 - 1 CVEs
• Wso2 Carbon Identity Application - 1 CVEs
• Wso2 Carbon Identity Application Authentication Endpointutils - 1 CVEs
• Wso2 Carbon Identity Client Attestation Met Data Mgt Be - 1 CVEs
• Wso2 Carbon Identity Core - 1 CVEs
• Wso2 Carbon Identity Entitlement Ui - 1 CVEs
• Wso2 Carbon Identity Management - 1 CVEs
• Wso2 Carbon Identity Management Endpoint Util - 1 CVEs
• Wso2 Carbon Identity Management Ui1 - 1 CVEs
• Wso2 Carbon Identity Oauth - 1 CVEs
• Wso2 Carbon Identity Recovery Management - 1 CVEs
• Wso2 Carbon Identity User Store - 1 CVEs
• Wso2 Carbon Identity User Store Configuration - 1 CVEs
• Wso2 Carbon Logging Services - 1 CVEs
• Wso2 Carbon Logging Ui - 1 CVEs
• Wso2 Carbon New Data Sources Ui - 1 CVEs
• Wso2 Carbon Policy Editor Be - 1 CVEs
• Wso2 Carbon Publish Event Mediator Configuration Ui - 1 CVEs
• Wso2 Carbon Registry Indexing - 1 CVEs
• Wso2 Carbon Registry Info Ui2 - 1 CVEs
• Wso2 Carbon Registry Profiles Ui - 1 CVEs
• Wso2 Carbon Registry Properties Ui - 1 CVEs
• Wso2 Carbon Registry Relations Ui - 1 CVEs
• Wso2 Carbon Registry Search Ui - 1 CVEs
• Wso2 Carbon Rest Api Admin Ui - 1 CVEs
• Wso2 Carbon Rule Mediator Ui - 1 CVEs
• Wso2 Carbon Scim 2.0 Common Component - 1 CVEs
• Wso2 Carbon Scim Common Component - 1 CVEs
• Wso2 Carbon Secured Http Log4j2 Appender - 1 CVEs
• Wso2 Carbon Security Ui - 1 CVEs
• Wso2 Carbon Sequence Editor Ui - 1 CVEs
• Wso2 Carbon Synapse Artifact Uploader Be - 1 CVEs
• Wso2 Carbon Task Ui - 1 CVEs
• Wso2 Carbon Tasks Core - 1 CVEs
• Wso2 Carbon Template Editor Ui - 1 CVEs
• Wso2 Carbon Throttle Mediator Ui - 1 CVEs
• Wso2 Carbon Ui - 1 CVEs
• Wso2 Carbon User Management Ui - 1 CVEs
• Wso2 Carborn Identity Handler - 1 CVEs
• Wso2 Enterprise Service Bus Analytics - 1 CVEs
• Wso2 Governance Registry - 1 CVEs
• Wso2 Integrator Mi For Visual Studio Code - 1 CVEs
• Wso2 Iot - 1 CVEs
• Wso2 Iot Server - 1 CVEs
• Wso2 Message Broker - 1 CVEs
• Wso2 Stratos Sso Redirector Ui Component - 1 CVEs
• Wso2 Stratos User Interface For Tenant Crud Operations - 1 CVEs
• Api Microgatewa - 0 CVEs
• Token Exchange Grant Type For Oauth - 0 CVEs

Newest CVEs of Wso2

• CVE-2026-78674 - CVSS 8.8 (high), 2026-10-28: The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the…
• CVE-2026-6647 - CVSS 7.4 (high), 2026-10-28: In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username…
• CVE-2026-3583 - CVSS 3.1 (low), 2026-10-28: When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a…
• CVE-2026-11854 - CVSS 6.1 (medium), 2026-10-28: The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding.…
• CVE-2025-14260 - CVSS 8.3 (high), 2026-10-28: Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing…
• CVE-2024-6423 - CVSS 4 (medium), 2026-10-21: The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not…
• CVE-2025-0326, 2026-10-21: The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password…
• CVE-2024-7478 - CVSS 5.8 (medium), 2026-10-21: When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during…
• CVE-2024-5563 - CVSS 4.8 (medium), 2026-10-21: Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha option is enabled. This oversight…
• CVE-2024-4989 - CVSS 5.4 (medium), 2026-10-21: The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this…
• CVE-2024-5139 - CVSS 6.1 (medium), 2026-10-21: The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This…
• CVE-2024-2323 - CVSS 4.8 (medium), 2026-10-20: The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This…
• CVE-2024-4412 - CVSS 2.7 (low), 2026-10-19: The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to…
• CVE-2025-13173 - CVSS 6.5 (medium), 2026-10-19: Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs…
• CVE-2025-13591 - CVSS 5.3 (medium), 2026-10-19: The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing…
• CVE-2025-10149 - CVSS 8.2 (high), 2026-10-19: The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a…
• CVE-2025-7203 - CVSS 4.9 (medium), 2026-10-19: The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore passwords, in…
• CVE-2025-7043 - CVSS 5.4 (medium), 2026-10-19: The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for…
• CVE-2025-6623 - CVSS 4.3 (medium), 2026-10-19: The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious…
• CVE-2024-4457 - CVSS 9.1 (critical), 2026-10-18: The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially…
• CVE-2024-8122 - CVSS 5.9 (medium), 2026-10-08: The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA). This allows…
• CVE-2025-13166 - CVSS 3.7 (low), 2026-09-15: The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses…
• CVE-2025-5802 - CVSS 5.3 (medium), 2026-09-15: The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts…
• CVE-2026-19515 - CVSS 7 (high), 2026-09-15: The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from…
• CVE-2026-4103 - CVSS 6.4 (medium), 2026-09-14: Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or…
• CVE-2026-3096 - CVSS 4.7 (medium), 2026-09-10: The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains access to the…
• CVE-2025-12737 - CVSS 8.4 (high), 2026-09-03: The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with…
• CVE-2026-3416 - CVSS 7.5 (high), 2026-09-03: The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation.…
• CVE-2026-3418 - CVSS 9.1 (critical), 2026-08-06: The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written…
• CVE-2026-3415 - CVSS 8.7 (high), 2026-08-06: The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the…