119
CVEs
11
Critical
22
High
1
KEV
20
PoC
15
Unpatched C/H
51.3%
Patch Rate
3.1%
Avg EPSS
Severity Breakdown
CRITICAL
11
HIGH
22
MEDIUM
79
LOW
7
Monthly CVE Trend
Affected Products (30)
Api Manager
53
Identity Server
49
Identity Server As Key Manager
33
Enterprise Integrator
25
Wso2 Api Manager
22
Wso2 Identity Server
22
Open Banking Iam
17
Wso2 Api Control Plane
13
Api Control Plane
12
Open Banking Am
12
Wso2 Traffic Manager
11
Wso2 Universal Gateway
11
Wso2 Open Banking Iam
10
Traffic Manager
10
Api Microgateway
10
Wso2 Identity Server As Key Manager
10
Universal Gateway
9
Wso2 Open Banking Am
9
Api Manager Analytics
9
Identity Server Analytics
9
Iot Server
7
Open Banking Km
6
Data Analytics Server
6
Micro Integrator
4
Dashboard Server
4
Open Redirect
3
Wso2 Carbon Identity Application Authentication Framework
3
Wso2 Carbon Api Manager Rest Api Utility
3
Carbon
3
Wso2 Carbon Magiclink Authenticator Module
3
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2022-29464 | Certain WSO2 products allow unrestricted file upload with resultant remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 100.0% | 84 |
KEV
PoC
No patch
|
| CVE-2016-4314 | Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 23.3%. | MEDIUM | 4.9 | 23.3% | 68 |
PoC
|
| CVE-2024-7097 | An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. Epss exploitation probability 25.2% and no vendor patch available. | MEDIUM | 4.3 | 25.2% | 67 |
PoC
No patch
|
| CVE-2020-24589 | The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing. | CRITICAL | 9.1 | 26.9% | 66 |
PoC
|
| CVE-2016-4311 | Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote attackers to hijack the authentication of privileged users for requests that. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | HIGH | 8.8 | 0.3% | 64 |
PoC
|
| CVE-2016-4312 | XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Public exploit code available. | HIGH | 7.5 | 5.4% | 63 |
PoC
|
| CVE-2016-4316 | Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) setName parameter to. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.1 | 3.2% | 54 |
PoC
No patch
|
| CVE-2016-4315 | Cross-site request forgery (CSRF) vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to hijack the authentication of privileged users for requests that shutdown a server via a shutdown action. Rated medium severity (CVSS 5.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available. | MEDIUM | 5.7 | 2.7% | 51 |
PoC
|
| CVE-2016-4327 | Cross-site scripting (XSS) vulnerability in WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20090827-1616 and earlier allows remote attackers to inject arbitrary web script or HTML via the. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.1 | 0.2% | 51 |
PoC
No patch
|
| CVE-2020-14446 | An issue was discovered in WSO2 Identity Server through 5.10.0 and WSO2 IS as Key Manager through 5.10.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.1 | 0.8% | 50 |
PoC
No patch
|
| CVE-2020-27885 | Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.1 | 0.9% | 50 |
PoC
No patch
|
| CVE-2022-29548 | A reflected XSS issue exists in the Management Console of several WSO2 products. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.1 | 41.1% | 50 |
PoC
No patch
|
| CVE-2022-4520 | A vulnerability was found in WSO2 carbon-registry up to 4.8.11. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | MEDIUM | 6.1 | 0.7% | 50 |
PoC
|
| CVE-2023-31664 | A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.1 | 1.2% | 50 |
PoC
No patch
|
| CVE-2026-5430 | Authentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane, and the Carbon API Manager REST API Utility) allows remote unauthenticated attackers to forge JWT tokens because the authentication layer accepts tokens signed with algorithms outside the explicitly configured/supported set. By crafting a JWT with an unsupported or attacker-chosen algorithm that is then incorrectly validated, an attacker can gain unauthorized access up to full administrative account takeover. Rated CVSS 10.0 (scope-changed) by WSO2, with the description noting a contained 9.8 score for single-tenant deployments; no public exploit identified at time of analysis. | CRITICAL | 10.0 | 0.2% | 50 |
PoC
|