AM
Product
Api Manager
On CISA KEVExploited in the wildRansomware-linked
95
CVEs
2
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 16High 20Medium 58Low 1
Watch
Add Api Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-8325 | 8.8 | May 11 | Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations Affected: 3.2.0 before 3.2.0.435; 3.2.1 before 3.2.1.55; 4.0.0 before 4.0.0.355; 4.1.0 before 4.1.0.219; 4.2.0 before 4.2.0.157; 4.3.0 before 4.3.0.70; +2 more |
| CVE-2025-6670 | 8.8 | Nov 18 | A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services,… Affected: 3.1.0; 3.2.0; 3.2.1; 4.0.0; 4.1.0; 4.2.0; +4 more |
| CVE-2020-24705 | 8.8 | Aug 27 | An issue was discovered in certain WSO2 products Affected: through 3.1.0 |
| CVE-2020-24703 | 8.8 | Aug 27 | An issue was discovered in certain WSO2 products Affected: 2.2.0 |
| CVE-2026-4249 | 8.6 | Jul 6 | Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption Affected: 4.0.0 before 4.0.0.390; 4.1.0 before 4.1.0.254; 4.2.0 before 4.2.0.194; 4.3.0 before 4.3.0.105; 4.4.0 before 4.4.0.69; 4.5.0 before 4.5.0.54; +1 more |
| CVE-2025-12737 | 8.4 | Sep 3 | Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution Affected: 3.1.0 before 3.1.0.349; 3.2.0 before 3.2.0.453; 3.2.1 before 3.2.1.73; 4.0.0 before 4.0.0.373; 4.1.0 before 4.1.0.236; 4.2.0 before 4.2.0.176; +4 more |
| CVE-2023-6837 | 8.2 | Dec 15 | Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning Affected: 2.5.0 before 2.5.0.32; 2.6.0 before 2.6.0.52; 3.0.0 before 3.0.0.50; 3.1.0 before 3.1.0.72; 3.2.0 before 3.2.0.86; 4.0.0 before 4.0.0.35 |
| CVE-2024-1524 | 8.1 | Feb 24 | A local user can be impersonated when using federated authentication with Silent JIT Provisioning. Affected: 4.2.0 before 4.2.0.108 |
| CVE-2026-3416 | 7.5 | Sep 3 | Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads Affected: 4.1.0 before 4.1.0.253; 4.2.0 before 4.2.0.193; 4.3.0 before 4.3.0.104; 4.4.0 before 4.4.0.68; 4.5.0 before 4.5.0.52 |
| CVE-2024-6832 | 7.5 | Aug 6 | Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks Affected: 3.1.0; 3.2.0; 3.2.1; 4.1.0; 4.2.0; 4.3.0; +3 more |
| CVE-2025-8154 | 7.5 | May 11 | HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation Affected: 4.1.0 before 4.1.0.218; 4.2.0 before 4.2.0.164; 4.3.0 before 4.3.0.74; 4.4.0 before 4.4.0.38; 4.5.0 before 4.5.0.20 |
| CVE-2024-8010 | 7.5 | Apr 16 | XML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files Affected: 3.2.0 before 3.2.0.397; 3.2.1 before 3.2.1.27; 4.0.0 through 4.0.0.310; 4.1.0 before 4.1.0.171; 4.2.0 before 4.2.0.127; 4.3.0 before 4.3.0.39 |
| CVE-2023-6836 | 7.5 | Dec 15 | Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access… Affected: through 3.0.0 |
| CVE-2025-13475 | 7.3 | Jul 4 | Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure Affected: 3.2.0 before 3.2.0.457; 3.2.1 before 3.2.1.76 |
| CVE-2025-13590 | 7.2 | Feb 19 | Authenticated arbitrary file upload via a System REST API requiring administrator permission. Affected: 4.2.0; 4.3.0; 4.4.0; 4.5.0; 4.6.0 |
| CVE-2025-11093 | 7.2 | Nov 5 | An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines Affected: 3.1.0 before 3.1.0.345; 3.2.0 before 3.2.0.446; 3.2.1 before 3.2.1.66; 4.1.0 before 4.1.0.228; 4.2.0 before 4.2.0.169; 4.3.0 before 4.3.0.81; +2 more |
| CVE-2025-10907 | 7.2 | Nov 5 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services Affected: 3.1.0; 3.2.0; 3.2.1; 4.0.0; 4.1.0; 4.2.0; +3 more |
| CVE-2025-3125 | 7.2 | Nov 5 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint Affected: 3.2.0; 3.2.1; 4.0.0; 4.1.0; 4.2.0; 4.3.0; +2 more |
| CVE-2025-5717 | 7.2 | Sep 23 | An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service Affected: 3.0.0; 3.1.0; 3.2.0; 3.2.1; 4.0.0; 4.1.0; +4 more |
| CVE-2020-12719 | 7.2 | May 8 | XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microgateway 2.2.0,… Affected: through 3.0.0 |
Showing 20