Login Request a demo
AM
Product
Api Manager
by Wso2 · last CVE Sep 3, 2026
On CISA KEVExploited in the wildRansomware-linked
95
CVEs
2
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities95In the news3Timeline
Severity mix
Critical 16High 20Medium 58Low 1
Severity
All severities95Critical16High20Medium58Low1
Exploitation
On CISA KEV2Exploited in the wild2
Watch

Add Api Manager to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-13883
6.7
1%
Jun 6
In WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5.9.0 and earlier, Management Console allows XXE during addition or update of a…
Affected: through 3.0.0
CVE-2025-9804
6.5
1%
Oct 16
Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
Affected: 2.0.0; 2.1.0; 2.2.0; 2.5.0; 2.6.0; 3.0.0; +9 more
CVE-2024-4598
6.5
0%
Sep 23
Information Disclosure in Multiple WSO2 Products Due to Improper Handling in Enrich Mediator
Affected: 3.2.0 before 3.2.0.422; 3.2.1 before 3.2.1.42; 4.1.0 before 4.1.0.152; 4.3.0 before 4.3.0.55
CVE-2020-24591
6.5
1%
Aug 21
The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates
Affected: through 3.0.0
CVE-2026-2445
6.1
0%
Jul 20
Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification
Affected: 4.2.0 before 4.2.0.195; 4.3.0 before 4.3.0.106; 4.4.0 before 4.4.0.70; 4.5.0 before 4.5.0.55; 4.6.0 before 4.6.0.19
CVE-2025-8591
6.1
0%
Jul 6
Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification
Affected: 3.1.0 before 3.1.0.355; 3.2.0 before 3.2.0.459; 3.2.1 before 3.2.1.78; 4.0.0 before 4.0.0.380; 4.1.0 before 4.1.0.243; 4.2.0 before 4.2.0.183; +4 more
CVE-2025-6024
6.1
0%
Apr 16
Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites
Affected: 3.1.0; 3.2.0; 3.2.1; 4.0.0; 4.1.0
CVE-2024-10242
6.1
0%
Apr 16
Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 API Manager Allows UI Modification and Redirection
Affected: 3.2.0 before 3.2.0.401; 4.0.0 before 4.0.0.318
CVE-2025-10853
6.1
0%
Nov 5
Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding
Affected: 3.1.0; 3.2.0; 3.2.1; 4.0.0; 4.1.0; 4.2.0; +3 more
CVE-2025-5770
6.1
0%
Nov 5
Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products
Affected: 4.2.0; 4.3.0; 4.4.0; 4.5.0
CVE-2024-1440
6.1
0%
Jun 2
An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option…
Affected: 3.1.0; 3.2.0; 4.0.0
CVE-2024-5962
6.1
0%
May 22
A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoint of multiple WSO2 products due to missing output encoding of user-supplied input
Affected: 4.2.0; 4.3.0
CVE-2024-5848
6.1
0%
Feb 27
A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper input validation
Affected: 3.1.0; 3.2.0; 3.2.1; 4.0.0; 4.1.0; 4.2.0; +1 more
CVE-2023-6838
6.1
0%
Dec 15
Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint
Affected: 3.1.0; 3.2.0
CVE-2023-31664
6.1
1%
May 23
A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers to execute arbitrary web scripts or HTML…
Affected: before 4.2.0
CVE-2022-29548
6.1
41%
Apr 21
A reflected XSS issue exists in the Management Console of several WSO2 products
Affected: 2.2.0; 2.5.0; 2.6.0; 3.0.0; 3.1.0; 3.2.0; +1 more
CVE-2021-36760
6.1
1%
Dec 7
In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL…
Affected: 3.0.0; 3.1.0; 3.2.0; 4.0.0
CVE-2020-17453
6.1
26%
Apr 5
WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter
Affected: through 3.2.0
CVE-2020-27885
6.1
1%
Oct 29
Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0
Affected: 3.1.0
CVE-2020-17454
6.1
1%
Oct 21
WSO2 API Manager 3.1.0 and earlier has reflected XSS on the "publisher" component's admin interface
Affected: through 3.1.0
CVE-2020-24706
6.1
1%
Aug 27
An issue was discovered in certain WSO2 products
Affected: through 3.1.0
CVE-2020-24704
6.1
1%
Aug 27
An issue was discovered in certain WSO2 products
Affected: 2.2.0
CVE-2019-20437
6.1
1%
Jan 28
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0
Affected: 2.6.0
CVE-2019-20436
6.1
1%
Jan 28
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0
Affected: 2.6.0
CVE-2024-10302
5.8
0%
Aug 6
Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure
Affected: 3.1.0; 3.2.0; 3.2.1; 4.0.0; 4.1.0; 4.2.0; +2 more
CVE-2024-2321
5.6
0%
Feb 27
An incorrect authorization vulnerability exists in multiple WSO2 products, allowing protected APIs to be accessed directly using a refresh token instead of the expected access…
Affected: 4.0.0; 4.1.0; 4.2.0
CVE-2025-13394
5.4
0%
Aug 6
Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions
Affected: 3.1.0 before 3.1.0.352; 3.2.0 before 3.2.0.456; 3.2.1 before 3.2.1.75; 4.0.0 before 4.0.0.376; 4.1.0 before 4.1.0.239; 4.2.0 before 4.2.0.179; +4 more
CVE-2024-4867
5.4
0%
Apr 16
Cross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information Retrieval
Affected: 3.2.0 before 3.2.0.408; 3.2.1 before 3.2.1.32; 4.0.0 before 4.0.0.293; 4.1.0 before 4.1.0.187
CVE-2024-7096
5.4
1%
May 30
A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services
Affected: 2.0.0; 2.1.0; 2.2.0; 2.5.0; 2.6.0; 3.0.0; +7 more
CVE-2019-6513
5.4
1%
May 21
An issue was discovered in WSO2 API Manager 2.6.0
Affected: 2.6.0
CVE-2018-20736
5.4
1%
Mar 18
An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0
Affected: 2.6.0
CVE-2018-20737
5.4
1%
Mar 18
An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0
Affected: 2.6.0
CVE-2024-1248
5.3
0%
Jul 4
Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation
Affected: 3.0.0 before 3.0.0.153; 3.1.0 before 3.1.0.267; 3.2.0 before 3.2.0.351; 4.0.0 before 4.0.0.269; 4.1.0 before 4.1.0.169
CVE-2025-5605
5.3
1%
Oct 24
Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure
Affected: 3.1.0; 3.2.0; 3.2.1; 4.0.0; 4.1.0; 4.2.0; +3 more
CVE-2023-6839
5.3
1%
Dec 15
Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in the HTTP response
Affected: 3.0.0; 3.1.0; 3.2.0; 4.0.0
CVE-2023-6835
5.3
1%
Dec 15
Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated
Affected: 2.2.0; 2.5.0; 2.6.0
CVE-2019-6515
5.3
2%
May 14
An issue was discovered in WSO2 API Manager 2.6.0
Affected: 2.6.0
CVE-2024-8008
5.2
1%
Jun 2
Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation
Affected: 3.1.0; 3.2.0; 3.2.1; 4.0.0; 4.1.0; 4.2.0; +1 more
CVE-2024-8995
4.9
0%
Aug 6
Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access
Affected: 3.1.0 before 3.1.0.320; 3.2.0 before 3.2.0.413; 3.2.1 before 3.2.1.90; 4.0.0 before 4.0.0.334; 4.1.0 before 4.1.0.255; 4.2.0 before 4.2.0.195; +4 more
CVE-2025-5350
4.8
1%
Oct 24
SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products
Affected: 3.1.0; 3.2.0; 3.2.1; 4.0.0; 4.1.0; 4.2.0; +3 more
CVE-2025-4760
4.8
0%
Sep 23
Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher
Affected: 3.2.0; 3.2.1; 4.1.0; 4.2.0; 4.3.0; 4.4.0; +1 more
CVE-2023-6911
4.8
0%
Dec 18
Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a…
Affected: 2.2.0; 2.5.0; 2.6.0; 3.0.0; 3.1.0; 3.2.0
CVE-2019-20439
4.8
1%
Jan 28
An issue was discovered in WSO2 API Manager 2.6.0
Affected: 2.6.0
CVE-2019-20438
4.8
1%
Jan 28
An issue was discovered in WSO2 API Manager 2.6.0
Affected: 2.6.0
CVE-2019-20435
4.8
1%
Jan 28
An issue was discovered in WSO2 API Manager 2.6.0
Affected: 2.6.0
CVE-2019-20434
4.8
1%
Jan 28
An issue was discovered in WSO2 API Manager 2.6.0
Affected: 2.6.0
CVE-2019-20443
4.8
1%
Jan 28
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0
Affected: 2.6.0
CVE-2019-20442
4.8
1%
Jan 28
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0
Affected: 2.6.0
CVE-2019-20441
4.8
1%
Jan 28
An issue was discovered in WSO2 API Manager 2.6.0
Affected: 2.6.0
CVE-2019-20440
4.8
1%
Jan 28
An issue was discovered in WSO2 API Manager 2.6.0
Affected: 2.6.0
Page 1 of 2 · 58 total
12