Vendor

OSGeo

No CISA KEV deadline is open. CISA last added an OSGeo CVE on 11 Dec 2025.

Tracked since 22 Jul · latest article Wed 22 Jul · RSS

Open KEV deadlines: 0; None open
Added to KEV · 90 days: 0; of 3 in the full CISA catalogue · all time
High exploit odds · current: 0; EPSS top 5%, not in KEV
Articles · 7 days: 0; none this week

Exploited, by due date

CSV download

CVEProductAddedDue · federal deadline

Deadlines passed

CVE-2025-58360not in CyberSIXT coverageGeoServer11 Dec 2025Deadline passed 1 Jan

CVE-2024-36401GeoServer15 Jul 2024Deadline passed 5 Aug 20241 article

CVE-2022-24816not in CyberSIXT coverageJAI-EXT26 Jun 2024Deadline passed 17 Jul 2024

Products

2 products · 1 CVE in coverage

GeoServer1 CVE · 2 in KEVlatest 22 Jul JAI-EXT0 CVEs · 1 in KEV

Coverage

1 article · all timeFull timeline

One article so far, 22 Jul. A pattern appears once more outlets cover OSGeo.

Wed 22 Jul · first reportRondo botnet revives Geoserver flaw, exploiting CVE-2024-36401SANS ISC

Named in the same articles

Threat actors · articles in common

Rondo botnet 1

All CVEs in coverage

CVE-2024-36401OSGeo GeoServer GeoTools Eval Injection VulnerabilityCVSS9.8CriticalExploited99.8%EPSS1article

How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.

OSGeo

Exploited, by due date

Products

Coverage

Named in the same articles

All CVEs in coverage

On this device

Intel

Settings

Keyboard shortcuts