Login Request a demo
AM
Product
Api Manager
by Wso2 · last CVE Sep 3, 2026
On CISA KEVExploited in the wildRansomware-linked
95
CVEs
2
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities95In the news3Timeline
Severity mix
Critical 16High 20Medium 58Low 1
Severity
All severities95Critical16High20Medium58Low1
Exploitation
On CISA KEV2Exploited in the wild2
Watch

Add Api Manager to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-5430
In wildKEV
10.0
22%
Aug 6
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
Affected: 4.1.0 before 4.1.0.257; 4.2.0 before 4.2.0.197; 4.3.0 before 4.3.0.108; 4.4.0 before 4.4.0.72; 4.5.0 before 4.5.0.57; 4.6.0 before 4.6.0.21
CVE-2022-29464
RansomwareIn wildKEV
9.8
100%
Apr 18
WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
Affected: 2.2.0 through 4.0.0
CVE-2026-2053
10.0
0%
Jun 26
Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager
Affected: 3.1.0 before 3.1.0.360; 3.2.0 before 3.2.0.465; 3.2.1 before 3.2.1.84; 4.0.0 before 4.0.0.385; 4.2.0 before 4.2.0.189
CVE-2026-1728
9.8
0%
Aug 6
Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover
Affected: 4.0.0 before 4.0.0.384; 4.1.0 before 4.1.0.248; 4.2.0 before 4.2.0.188; 4.3.0 before 4.3.0.99; 4.4.0 before 4.4.0.63; 4.5.0 before 4.5.0.48; +1 more
CVE-2025-9312
9.8
0%
Nov 18
A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products
Affected: 2.2.0; 2.5.0; 2.6.0; 3.0.0; 3.1.0; 3.2.0; +7 more
CVE-2025-9152
9.8
1%
Oct 16
An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client…
Affected: 3.2.0; 3.2.1; 4.0.0; 4.1.0; 4.2.0; 4.3.0; +2 more
CVE-2025-10611
9.8
1%
Oct 16
Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be…
Affected: 2.1.0; 2.2.0; 2.5.0; 2.6.0; 3.0.0; 3.1.0; +8 more
CVE-2024-6914
9.8
1%
May 22
An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service
Affected: 2.2.0; 2.5.0; 2.6.0; 3.0.0; 3.1.0; 3.2.0; +5 more
CVE-2020-13226
9.8
2%
May 20
WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intranet
Affected: 3.0.0
CVE-2025-15039
9.4
1%
Aug 6
Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
Affected: 2.6.0 before 2.6.0.150; 3.0.0 before 3.0.0.180; 3.1.0 before 3.1.0.356; 3.2.0 before 3.2.0.460; 3.2.1 before 3.2.1.79; 4.0.0 before 4.0.0.381; +6 more
CVE-2024-2374
9.1
0%
Apr 16
XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service
Affected: 3.1.0 before 3.1.0.278; 3.2.0 before 3.2.0.368; 4.0.0 before 4.0.0.280; 4.1.0 before 4.1.0.206; 4.2.0 before 4.2.0.144; 4.3.0 before 4.3.0.57
CVE-2025-10713
9.1
0%
Nov 5
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser
Affected: 3.1.0; 3.2.0; 3.2.1; 4.0.0; 4.1.0; 4.2.0; +3 more
CVE-2025-2905
9.1
1%
May 5
Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple…
Affected: through 2.0.0
CVE-2021-42646
9.1
4%
May 11
XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0;…
Affected: 2.6.0; 3.0.0; 3.1.0; 3.2.0; 4.0.0
CVE-2020-24590
9.1
1%
Aug 21
The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks
Affected: through 3.1.0
CVE-2020-24589
9.1
26%
Aug 21
The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks
Affected: through 3.1.0
Showing 16