IS
Product
Identity Server
On CISA KEVExploited in the wildRansomware-linked
83
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 19Medium 52Low 4
Watch
Add Identity Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-29464 RansomwareIn wildKEV | 9.8 | Apr 18 | WSO2 Multiple Products Unrestrictive Upload of File Vulnerability Affected: 5.2.0 through 5.11.0 |
| CVE-2025-9312 | 9.8 | Nov 18 | A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products Affected: 5.2.0; 5.3.0; 5.4.0; 5.4.1; 5.5.0; 5.6.0; +10 more |
| CVE-2025-10611 | 9.8 | Oct 16 | Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be… Affected: 5.3.0; 5.5.0; 5.6.0; 5.7.0; 5.8.0; 5.9.0; +6 more |
| CVE-2024-6914 | 9.8 | May 22 | An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service Affected: 5.3.0; 5.4.0; 5.4.1; 5.5.0; 5.6.0; 5.7.0; +7 more |
| CVE-2025-15039 | 9.4 | Aug 6 | Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products Affected: 5.7.0 before 5.7.0.130; 5.8.0 before 5.8.0.133; 5.9.0 before 5.9.0.173; 5.10.0 before 5.10.0.385; 5.11.0 before 5.11.0.432; 6.0.0 before 6.0.0.259; +4 more |
| CVE-2024-2374 | 9.1 | Apr 16 | XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service Affected: 5.10.0 before 5.10.0.300; 5.11.0 before 5.11.0.329; 6.0.0 before 6.0.0.179; 6.1.0 before 6.1.0.136 |
| CVE-2025-10713 | 9.1 | Nov 5 | An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser Affected: 5.10.0; 5.11.0; 7.1.0 |
| CVE-2021-42646 | 9.1 | May 11 | XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0;… Affected: 5.7.0; 5.8.0; 5.9.0; 5.10.0; 5.11.0 |
Showing 8