Vendor
WSO2
- CVEs tracked · all time
- 4
- in CISA KEV · all time
- 1
- articles · since 11 Sep
- 4
- articles · all time
- 6
4 articles since 11 Sep; 1 CISA notice, marked below the bars.
Show as table
| Day (UTC) | Articles |
|---|---|
| Wed 16 Sep | 1 |
| Thu 24 Sep | 1 |
| Fri 25 Sep | 2 |
Products: WSO2 API Control Plane, WSO2 API Manager, WSO2 API Manager Publisher REST API V4, WSO2 Carbon API Management API and 11 more
WSO2 API Control PlaneWSO2 API ManagerWSO2 API Manager Publisher REST API V4WSO2 Carbon API Management APIWSO2 Carbon API Management ImplementationWSO2 Carbon API Manager Rest API Common FunctionsWSO2 Carbon API Manager Rest API UtilityWSO2 Carbon Identity Application Authentication FrameworkWSO2 Identity ServerWSO2 Identity Server as Key ManagerWSO2 Open Banking AMWSO2 Open Banking IAMWSO2 Open Banking KMWSO2 Traffic ManagerWSO2 Universal Gateway
CVEs
4 CVEsCVE-2026-5430WSO2 Multiple Products Path Traversal VulnerabilityCVSS10.0CriticalExploited22%EPSS6articles
CVE-2026-1728Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account TakeoverCVSS9.8Critical–Not in KEV0.5%EPSS1article
CVE-2025-15039Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 ProductsCVSS9.4Critical–Not in KEV0.7%EPSS1article
CVE-2026-3418Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code ExecutionCVSS9.1Critical–Not in KEV0.8%EPSS1article
- CISA Flags Critical WSO2 and Magento Flaws Used in AttacksSecurity Affairs
- CISA Warns of Exploited WSO2 and Adobe Commerce FlawsSecurityOnline
- CISA Warns of Active Exploits Targeting Critical WSO2 FlawCISA · official notice
- Critical WSO2 Flaw Exploited to Steal API Credentials and SecretsSecurityWeek
- WSO2 Flaws Enable Account Takeover Via JWT Bypass, Patch UrgedSecurityOnline
- WSO2 patches critical JWT bypass flaw, putting bank APIs at riskSecurityOnline · first in our coverage