WC
Product
WSO2 Carbon API Management Implementation
5
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 2High 3Medium 0Low 0
Watch
Add WSO2 Carbon API Management Implementation to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-3418 | 9.1 | Aug 6 | Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution Affected: 9.30.67 before 9.30.67.156; 9.31.86 before 9.31.86.141; 9.32.147 before 9.32.147.44 |
| CVE-2025-14561 | 9.0 | Aug 6 | Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations Affected: 9.20.74 before 9.20.74.388; 9.28.116 before 9.28.116.395; 9.29.120 before 9.29.120.213; 9.30.67 before 9.30.67.135; 9.31.86 before 9.31.86.108; 9.32.147 before 9.32.147.5 |
| CVE-2025-8325 | 8.8 | May 11 | Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations Affected: 6.7.206 before 6.7.206.563; 6.7.210 before 6.7.210.55; 9.0.174 before 9.0.174.513; 9.20.74 before 9.20.74.375; 9.28.116 before 9.28.116.352; 9.29.120 before 9.29.120.177; +2 more |
| CVE-2026-3415 | 8.7 | Aug 6 | XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service Affected: 6.7.206 before 6.7.206.594; 6.7.210 before 6.7.210.95; 9.20.74 before 9.20.74.398; 9.28.116 before 9.28.116.412; 9.29.120 before 9.29.120.228; 9.30.67 before 9.30.67.158; +2 more |
| CVE-2025-8154 | 7.5 | May 11 | HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation Affected: 9.20.74 before 9.20.74.374; 9.28.116 before 9.28.116.363; 9.29.120 before 9.29.120.181; 9.30.67 before 9.30.67.104; 9.31.86 before 9.31.86.64 |
Showing 5