Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how wso2 compares to other vendors in security performance

View Risk Score →

Software

wso2 api manager
67
wso2 identity server
50
wso2 enterprise integrator
24
wso2 api control plane
11
wso2 api manager analytics
11
wso2 api microgateway
11
wso2 identity server analytics
11
wso2 identity server as key manager
10
wso2 open banking iam
10
wso2 traffic manager
10
wso2 universal gateway
10
wso2 wso2 identity server
10
wso2 products
9
wso2 data analytics server
7
wso2 iot server
7
wso2 open banking am
7
wso2 wso2 api manager
6
wso2 wso2 products
6
wso2 micro integrator
5
wso2 dashboard server
4
wso2 carbon
3
wso2 governance registry
3
wso2 open banking km
3
wso2 application server
2
wso2 business process server
2
wso2 business rules server
2
wso2 complex event processor
2
wso2 data services server
2
wso2 enterprise mobility manager
2
wso2 enterprise service bus
2
wso2 machine learner
2
wso2 message broker
2
wso2 multiple products
2
wso2 api gateway
1
wso2 app manager
1
wso2 carbon console
1
wso2 carbon identity application authentication endpoint
1
wso2 carbonappuploader
1
wso2 enablement server for java
1
wso2 event publisher output adapter
1
wso2 multiple wso2 products
1
wso2 oauth plugin
1
wso2 soap services
1
wso2 storage server
1
wso2 system rest apis
1
wso2 transport http
1
wso2 wso2
1
wso2 wso2 carbon console
1
wso2 wso2 enterprise integrator
1
wso2 wso2 products (multi-tenant deployments)
1

WSO2 WSO2 Identity ServerAuthentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

Risk 87
Severity
10
First published (updated )
CVE-2026-5430

WSO2 WSO2 ProductsPrivilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover

Risk 86
Severity
9.8
First published (updated )
CVE-2026-1728

WSO2 WSO2 Identity ServerAccount Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

Risk 76
Severity
9.4
First published (updated )
CVE-2025-15039

WSO2 Event Publisher output adapterSensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products

Risk 26
Severity
4.4
First published (updated )
CVE-2026-0637

WSO2 WSO2 Carbon consoleCross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

Risk 34
Severity
5.4
First published (updated )
CVE-2025-13394
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

WSO2 WSO2 Identity ServerInformation Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure

Risk 22
Severity
4.3
First published (updated )
CVE-2025-13909

WSO2 WSO2 Identity ServerImproper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions

Risk 14
Severity
2.4
First published (updated )
CVE-2025-12627

WSO2 Identity ServerImproper Access Control via Secret Type Management API in WSO2 Identity Server

Risk 26
Severity
3.8
First published (updated )
CVE-2025-14779

WSO2 WSO2 Identity ServerImproper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]

Risk 22
Severity
4.3
First published (updated )
CVE-2025-11850

WSO2 WSO2 products with Multi-Attribute Login enabledUsername Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery

Risk 20
Severity
3.7
First published (updated )
CVE-2025-13736
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

WSO2 WSO2 ProductsAccount Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks

Risk 35
Severity
5.9
First published (updated )
CVE-2024-6832

WSO2 WSO2Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access

Risk 32
Severity
4.9
First published (updated )
CVE-2024-8995

WSO2 WSO2 ProductsReflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification

Risk 38
Severity
6.1
First published (updated )
CVE-2026-2445

WSO2 API ManagerDenial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption

Risk 49
Severity
8.6
First published (updated )
CVE-2026-4249

WSO2 API ManagerReflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification

Risk 38
Severity
6.1
First published (updated )
CVE-2025-8591
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

WSO2 API ManagerRole Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation

Risk 27
Severity
5.3
First published (updated )
CVE-2024-1248

WSO2 API ManagerCross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure

Risk 54
Severity
7.3
First published (updated )
CVE-2025-13475

WSO2 API ManagerUnauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager

Risk 87
Severity
10
First published (updated )
CVE-2026-2053

WSO2 WSO2 Identity ServerDenial-of-Service via Magic Link Authentication in WSO2 Identity Server Allows Service Unavailability

Risk 49
Severity
8.6
First published (updated )
CVE-2025-10470

WSO2 WSO2 Identity ServerAuthorization Bypass via Adaptive Authentication in WSO2 Identity Server Allows Cross-Organization Account Takeover

Risk 66
Severity
7.2
First published (updated )
CVE-2025-9973
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

WSO2 API ManagerImproper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations

Risk 79
Severity
8.8
First published (updated )
CVE-2025-8325

WSO2 API ManagerHTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation

Risk 43
Severity
7.5
First published (updated )
CVE-2025-8154

WSO2 Identity ServerAccount Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access

Risk 51
Severity
7.3
First published (updated )
CVE-2025-10908

WSO2 Identity ServerUsername Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery

Risk 27
Severity
5.3
First published (updated )
CVE-2024-0391

WSO2 WSO2 Identity ServerReflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity Server

Risk 38
Severity
6.1
First published (updated )
CVE-2025-10503
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

WSO2 WSO2 Identity ServerImproper Token Invalidation in WSO2 Identity Server Allows Access After Account Lock

Risk 44
Severity
6
First published (updated )
CVE-2025-12624

WSO2 API ManagerCross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites

Risk 38
Severity
6.1
First published (updated )
CVE-2025-6024

WSO2 API ManagerReflected Cross-Site Scripting via Authentication Endpoint in WSO2 API Manager Allows UI Modification and Redirection

Risk 38
Severity
6.1
First published (updated )
CVE-2024-10242

WSO2 API ManagerXML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files

Risk 43
Severity
7.5
First published (updated )
CVE-2024-8010

WSO2 API ManagerCross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information Retrieval

Risk 34
Severity
5.4
First published (updated )
CVE-2024-4867
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203