WC
Product
WSO2 Carbon API Manager Rest API Utility
On CISA KEVExploited in the wild
4
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 3High 1Medium 0Low 0
Watch
Add WSO2 Carbon API Manager Rest API Utility to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-5430 In wildKEV | 10.0 | Aug 6 | Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover Affected: 9.20.74 before 9.20.74.401; 9.28.116 before 9.28.116.417; 9.29.120 before 9.29.120.236; 9.30.67 before 9.30.67.167; 9.31.86 before 9.31.86.158; 9.32.147 before 9.32.147.59 |
| CVE-2026-1728 | 9.8 | Aug 6 | Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover Affected: 9.20.74 before 9.20.74.392 |
| CVE-2025-14561 | 9.0 | Aug 6 | Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations Affected: 9.20.74 before 9.20.74.388; 9.28.116 before 9.28.116.395; 9.29.120 before 9.29.120.213; 9.30.67 before 9.30.67.135; 9.31.86 before 9.31.86.108; 9.32.147 before 9.32.147.5 |
| CVE-2025-8325 | 8.8 | May 11 | Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations Affected: 6.7.206 before 6.7.206.563; 6.7.210 before 6.7.210.55; 9.0.174 before 9.0.174.513; 9.20.74 before 9.20.74.375; 9.28.116 before 9.28.116.352; 9.29.120 before 9.29.120.177; +2 more |
Showing 4