Login Request a demo
GE
Product
geoserver
by geoserver · last CVE Nov 25, 2025
On CISA KEVExploited in the wild
17
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities17In the news1Timeline
Severity mix
Critical 3High 3Medium 10Low 0
Severity
All severities17Critical3High3Medium10Low0
Exploitation
On CISA KEV2Exploited in the wild2
Watch

Add geoserver to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-58360
In wildKEV
9.8
61%
Nov 25
GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
Affected: >= 2.26.0, < 2.26.2; < 2.25.6
CVE-2024-36401
In wildKEV
9.8
100%
Jul 1
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
Affected: >= 2.23.0, < 2.23.6; >= 2.24.0, < 2.24.4; >= 2.25.0, < 2.25.2; < 2.22.6
Showing 2