en
Severity across 1 analyzed records
A short verification protects source data and prevents automated AI requests.
The GCVE catalog currently lists 94 vulnerability records affecting api_manager.
Among the 1 records analyzed by CyStack, 1 are High or Critical and 1 appear in the CISA KEV catalog.
Compare the version you run with each vulnerability and the provider guidance below. The data only includes records analyzed so far.
| CVE | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2025-12737Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution | Exploitation statusNot known exploited | FixYes | Published09/03/2026 | SeverityHigh |
CVE-2026-5430Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover | Exploitation statusNot known exploited | FixYes | Published08/06/2026 | SeverityCritical |
CVE-2026-1728Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover | Exploitation statusNot known exploited | FixYes | Published08/06/2026 | SeverityCritical |
CVE-2025-15039Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products | Exploitation statusNot known exploited | FixYes | Published08/06/2026 | SeverityCritical |
CVE-2026-0637Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products | Exploitation statusNot known exploited | FixYes | Published08/06/2026 | SeverityMedium |
CVE-2025-13394Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions | Exploitation statusNot known exploited | FixYes | Published08/06/2026 | SeverityMedium |
CVE-2025-13736Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery | Exploitation statusNot known exploited | FixYes | Published08/06/2026 | SeverityLow |
CVE-2024-10302Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure | Exploitation statusNot known exploited | FixYes | Published08/06/2026 | SeverityMedium |
CVE-2024-6832Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks | Exploitation statusNot known exploited | FixYes | Published08/06/2026 | SeverityMedium |
CVE-2024-8995Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access | Exploitation statusNot known exploited | FixYes | Published08/06/2026 | SeverityMedium |
CVE-2026-2445Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification | Exploitation statusNot known exploited | FixYes | Published07/20/2026 | SeverityMedium |
CVE-2026-4249Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption | Exploitation statusNot known exploited | FixYes | Published07/06/2026 | SeverityHigh |
CVE-2025-8591Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification | Exploitation statusNot known exploited | FixYes | Published07/06/2026 | SeverityMedium |
CVE-2024-1248Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation | Exploitation statusNot known exploited | FixYes | Published07/04/2026 | SeverityMedium |
CVE-2025-13475Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure | Exploitation statusNot known exploited | FixYes | Published07/04/2026 | SeverityLow |
CVE-2026-2053Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager | Exploitation statusNot known exploited | FixYes | Published06/26/2026 | SeverityHigh |
CVE-2025-8325Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations | Exploitation statusNot known exploited | FixYes | Published05/11/2026 | SeverityMedium |
CVE-2025-8154HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation | Exploitation statusNot known exploited | FixYes | Published05/11/2026 | SeverityMedium |
CVE-2025-6024Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites | Exploitation statusNot known exploited | FixYes | Published04/16/2026 | SeverityMedium |
CVE-2024-10242Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 API Manager Allows UI Modification and Redirection | Exploitation statusNot known exploited | FixYes | Published04/16/2026 | SeverityMedium |
CVE-2024-8010XML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files | Exploitation statusNot known exploited | FixYes | Published04/16/2026 | SeverityLow |
CVE-2024-4867Cross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information Retrieval | Exploitation statusNot known exploited | FixYes | Published04/16/2026 | SeverityMedium |
CVE-2024-2374XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service | Exploitation statusNot known exploited | FixYes | Published04/16/2026 | SeverityHigh |
CVE-2024-1524A local user can be impersonated when using federated authentication with Silent JIT Provisioning. | Exploitation statusNot known exploited | FixYes | Published02/24/2026 | SeverityHigh |
CVE-2025-13590Authenticated arbitrary file upload via a System REST API requiring administrator permission. | Exploitation statusNot known exploited | FixYes | Published02/19/2026 | SeverityCritical |
CVE-2025-9312Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products | Exploitation statusNot known exploited | FixYes | Published11/18/2025 | SeverityCritical |
CVE-2025-6670Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services | Exploitation statusNot known exploited | FixYes | Published11/18/2025 | SeverityHigh |
CVE-2025-10853Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding | Exploitation statusNot known exploited | FixYes | Published11/05/2025 | SeverityMedium |
CVE-2025-5770Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products | Exploitation statusNot known exploited | FixYes | Published11/05/2025 | SeverityMedium |
CVE-2025-11093Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS) | Exploitation statusNot known exploited | FixYes | Published11/05/2025 | SeverityHigh |
CVE-2025-10907Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution | Exploitation statusNot known exploited | FixYes | Published11/05/2025 | SeverityHigh |
CVE-2025-10713XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration | Exploitation statusNot known exploited | FixYes | Published11/05/2025 | SeverityMedium |
CVE-2025-3125Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution | Exploitation statusNot known exploited | FixYes | Published11/05/2025 | SeverityMedium |
CVE-2025-5605Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure | Exploitation statusNot known exploited | FixYes | Published10/24/2025 | SeverityMedium |
CVE-2025-5350SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products | Exploitation statusNot known exploited | FixYes | Published10/24/2025 | SeverityMedium |
CVE-2025-9152Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint | Exploitation statusNot known exploited | FixYes | Published10/16/2025 | SeverityCritical |
CVE-2025-9804Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs | Exploitation statusNot known exploited | FixYes | Published10/16/2025 | SeverityCritical |
CVE-2025-10611Potential Broken Access Control in Multiple WSO2 Products via System REST APIs | Exploitation statusNot known exploited | FixYes | Published10/16/2025 | SeverityCritical |
CVE-2024-6429Content Spoofing in Multiple WSO2 Products via Error Message Injection | Exploitation statusNot known exploited | FixYes | Published09/23/2025 | SeverityMedium |
CVE-2025-5717Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service | Exploitation statusNot known exploited | FixYes | Published09/23/2025 | SeverityMedium |
CVE-2025-4760Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher | Exploitation statusNot known exploited | FixYes | Published09/23/2025 | SeverityMedium |
CVE-2024-4598Information Disclosure in Multiple WSO2 Products Due to Improper Handling in Enrich Mediator | Exploitation statusNot known exploited | FixYes | Published09/23/2025 | SeverityMedium |
CVE-2024-3511Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files | Exploitation statusNot known exploited | FixYes | Published06/23/2025 | SeverityMedium |
CVE-2024-1440Open Redirection in Multiple WSO2 Products via Multi-Option Authentication Endpoint | Exploitation statusNot known exploited | FixYes | Published06/02/2025 | SeverityMedium |
CVE-2024-8008Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation | Exploitation statusNot known exploited | FixYes | Published06/02/2025 | SeverityMedium |
CVE-2024-3509Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor | Exploitation statusNot known exploited | FixYes | Published06/02/2025 | SeverityMedium |
CVE-2024-7097Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup | Exploitation statusNot known exploited | FixYes | Published05/30/2025 | SeverityMedium |
CVE-2024-7096Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw | Exploitation statusNot known exploited | FixYes | Published05/30/2025 | SeverityMedium |
CVE-2024-5962Reflected Cross-Site Scripting (XSS) in Authentication Endpoint of Multiple WSO2 Products Due to Missing Output Encoding | Exploitation statusNot known exploited | FixYes | Published05/22/2025 | SeverityMedium |
CVE-2024-6914Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover | Exploitation statusNot known exploited | FixYes | Published05/22/2025 | SeverityCritical |
CVE-2025-2905An XML External Entity (XXE) vulnerability in Multiple WSO2 Products | Exploitation statusNot known exploited | FixYes | Published05/05/2025 | SeverityCritical |
CVE-2024-5848Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products Due to Improper Input Validation | Exploitation statusNot known exploited | FixYes | Published02/27/2025 | SeverityMedium |
CVE-2024-2321Incorrect Authorization in Multiple WSO2 Products Allows API Access via Refresh Token | Exploitation statusNot known exploited | FixYes | Published02/27/2025 | SeverityMedium |
CVE-2023-6911CVE-2023-6911 | Exploitation statusNot confirmed | FixYes | Published12/18/2023 | SeverityMedium |
CVE-2023-6839CVE-2023-6839 | Exploitation statusNot known exploited | FixYes | Published12/15/2023 | SeverityMedium |
CVE-2023-6838CVE-2023-6838 | Exploitation statusNot confirmed | FixYes | Published12/15/2023 | SeverityMedium |
CVE-2023-6837Incorrect Authorization in Multiple WSO2 Products via Federated Authentication with JIT Provisioning Leading to User Impersonation | Exploitation statusNot confirmed | FixYes | Published12/15/2023 | SeverityHigh |
CVE-2023-6836CVE-2023-6836 | Exploitation statusNot confirmed | FixYes | Published12/15/2023 | SeverityMedium |
CVE-2023-6835CVE-2023-6835 | Exploitation statusNot confirmed | FixYes | Published12/15/2023 | SeverityMedium |
CVE-2023-31664CVE-2023-31664 | Exploitation statusPublic exploit | FixNot confirmed | Published05/23/2023 | SeverityMedium |
CVE-2021-42646CVE-2021-42646 | Exploitation statusNot confirmed | FixNot confirmed | Published05/11/2022 | SeverityUnknown |
CVE-2022-29548CVE-2022-29548 | Exploitation statusNot confirmed | FixNot confirmed | Published04/21/2022 | SeverityMedium |
CVE-2022-29464CVE-2022-29464 | Exploitation statusKEV | FixNot confirmed | Published04/18/2022 | SeverityCritical |
CVE-2021-36760CVE-2021-36760 | Exploitation statusNot confirmed | FixNot confirmed | Published12/07/2021 | SeverityUnknown |
CVE-2020-17453CVE-2020-17453 | Exploitation statusNot confirmed | FixNot confirmed | Published04/05/2021 | SeverityUnknown |
CVE-2020-27885CVE-2020-27885 | Exploitation statusNot confirmed | FixNot confirmed | Published10/29/2020 | SeverityUnknown |
CVE-2020-17454CVE-2020-17454 | Exploitation statusNot confirmed | FixNot confirmed | Published10/21/2020 | SeverityUnknown |
CVE-2020-24706CVE-2020-24706 | Exploitation statusNot confirmed | FixNot confirmed | Published08/27/2020 | SeverityMedium |
CVE-2020-24705CVE-2020-24705 | Exploitation statusNot confirmed | FixNot confirmed | Published08/27/2020 | SeverityHigh |
CVE-2020-24704CVE-2020-24704 | Exploitation statusNot confirmed | FixNot confirmed | Published08/27/2020 | SeverityMedium |
CVE-2020-24703CVE-2020-24703 | Exploitation statusNot confirmed | FixNot confirmed | Published08/27/2020 | SeverityHigh |
CVE-2020-24589CVE-2020-24589 | Exploitation statusNot confirmed | FixNot confirmed | Published08/21/2020 | SeverityCritical |
CVE-2020-24591CVE-2020-24591 | Exploitation statusNot confirmed | FixNot confirmed | Published08/21/2020 | SeverityMedium |
CVE-2020-24590CVE-2020-24590 | Exploitation statusNot confirmed | FixNot confirmed | Published08/21/2020 | SeverityCritical |
CVE-2020-13883CVE-2020-13883 | Exploitation statusNot confirmed | FixNot confirmed | Published06/06/2020 | SeverityMedium |
CVE-2020-13226CVE-2020-13226 | Exploitation statusNot confirmed | FixNot confirmed | Published05/20/2020 | SeverityUnknown |
CVE-2020-12719CVE-2020-12719 | Exploitation statusNot confirmed | FixNot confirmed | Published05/07/2020 | SeverityHigh |
CVE-2019-20434CVE-2019-20434 | Exploitation statusNot confirmed | FixNot confirmed | Published01/27/2020 | SeverityMedium |
CVE-2019-20435CVE-2019-20435 | Exploitation statusNot confirmed | FixNot confirmed | Published01/27/2020 | SeverityLow |
CVE-2019-20437CVE-2019-20437 | Exploitation statusNot confirmed | FixNot confirmed | Published01/27/2020 | SeverityMedium |
CVE-2019-20438CVE-2019-20438 | Exploitation statusNot confirmed | FixNot confirmed | Published01/27/2020 | SeverityMedium |
CVE-2019-20439CVE-2019-20439 | Exploitation statusNot confirmed | FixNot confirmed | Published01/27/2020 | SeverityLow |
CVE-2019-20440CVE-2019-20440 | Exploitation statusNot confirmed | FixNot confirmed | Published01/27/2020 | SeverityLow |
CVE-2019-20441CVE-2019-20441 | Exploitation statusNot confirmed | FixNot confirmed | Published01/27/2020 | SeverityMedium |
CVE-2019-20442CVE-2019-20442 | Exploitation statusNot confirmed | FixNot confirmed | Published01/27/2020 | SeverityLow |
CVE-2019-20443CVE-2019-20443 | Exploitation statusNot confirmed | FixNot confirmed | Published01/27/2020 | SeverityLow |
CVE-2019-20436CVE-2019-20436 | Exploitation statusNot confirmed | FixNot confirmed | Published01/27/2020 | SeverityMedium |
CVE-2019-15108CVE-2019-15108 | Exploitation statusNot confirmed | FixNot confirmed | Published08/16/2019 | SeverityLow |
CVE-2019-6513CVE-2019-6513 | Exploitation statusNot confirmed | FixNot confirmed | Published05/21/2019 | SeverityUnknown |
CVE-2019-6515CVE-2019-6515 | Exploitation statusNot confirmed | FixNot confirmed | Published05/14/2019 | SeverityUnknown |
CVE-2019-6512CVE-2019-6512 | Exploitation statusNot confirmed | FixNot confirmed | Published05/14/2019 | SeverityUnknown |
CVE-2018-20736CVE-2018-20736 | Exploitation statusNot confirmed | FixNot confirmed | Published03/18/2019 | SeverityUnknown |
CVE-2018-20737CVE-2018-20737 | Exploitation statusNot confirmed | FixNot confirmed | Published03/18/2019 | SeverityUnknown |
CVE-2017-14651CVE-2017-14651 | Exploitation statusNot confirmed | FixNot confirmed | Published09/21/2017 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
