AM
Product
Api Manager
On CISA KEVExploited in the wildRansomware-linked
95
CVEs
2
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 16High 20Medium 58Low 1
Watch
Add Api Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-15108 | 4.8 | Aug 16 | An issue was discovered in WSO2 API Manager 2.6.0 before WSO2-CARBON-PATCH-4.4.0-4457 Affected: through 2.6.0 |
| CVE-2017-14651 | 4.8 | Sep 21 | WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter Affected: 2.1.0 |
| CVE-2026-0637 | 4.4 | Aug 6 | Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Affected: 3.1.0 before 3.1.0.357; 3.2.0 before 3.2.0.465; 3.2.1 before 3.2.1.84; 4.1.0 before 4.1.0.249; 4.2.0 before 4.2.0.189; 4.3.0 before 4.3.0.100; +3 more |
| CVE-2024-6429 | 4.3 | Sep 23 | A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling Affected: 3.2.0; 3.2.1; 4.0.0; 4.1.0; 4.2.0; 4.3.0; +1 more |
| CVE-2024-3511 | 4.3 | Jun 23 | An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry Affected: 3.2.0; 3.2.1; 4.0.0; 4.1.0; 4.2.0; 4.3.0 |
| CVE-2024-3509 | 4.3 | Jun 2 | A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich Text Editor within… Affected: 3.2.0; 3.2.1; 4.0.0; 4.1.0; 4.2.0; 4.3.0 |
| CVE-2024-7097 | 4.3 | May 30 | An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the… Affected: 2.1.0; 2.2.0; 2.5.0; 2.6.0; 3.0.0; 3.1.0; +6 more |
| CVE-2019-6512 | 4.1 | May 14 | An issue was discovered in WSO2 API Manager 2.6.0 Affected: 2.6.0 |