Login Request a demo
WI
Product
WSO2 Identity Server
by WSO2 · last CVE Oct 28, 2026
73
CVEs
0
On KEV
9.8
Max CVSS
17
New 30D
Vulnerabilities73In the news0Timeline
Severity mix
Critical 7High 14Medium 44Low 7
Severity
All severities73Critical7High14Medium44Low7
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add WSO2 Identity Server to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-9312
9.8
0%
Nov 18
Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products
Affected: 5.2.0 before 5.2.0.33; 5.3.0 before 5.3.0.34; 5.4.0 before 5.4.0.33; 5.4.1 before 5.4.1.37; 5.5.0 before 5.5.0.51; 5.6.0 before 5.6.0.59; +9 more
CVE-2025-10611
9.8
1%
Oct 16
Potential Broken Access Control in Multiple WSO2 Products via System REST APIs
Affected: 5.3.0 before 5.3.0.39; 5.5.0 before 5.5.0.54; 5.6.0 before 5.6.0.62; 5.7.0 before 5.7.0.128; 5.8.0 before 5.8.0.112; 5.9.0 before 5.9.0.171; +6 more
CVE-2024-6914
9.8
1%
May 22
Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover
Affected: 5.3.0 before 5.3.0.31; 5.4.0 before 5.4.0.30; 5.4.1 before 5.4.1.35; 5.5.0 before 5.5.0.48; 5.6.0 before 5.6.0.56; 5.7.0 before 5.7.0.122; +7 more
CVE-2025-15039
9.4
1%
Aug 6
Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
Affected: 5.7.0 before 5.7.0.130; 5.8.0 before 5.8.0.113; 5.9.0 before 5.9.0.173; 5.10.0 before 5.10.0.385; 5.11.0 before 5.11.0.432; 6.0.0 before 6.0.0.259; +5 more
CVE-2024-4457
9.1
0%
Oct 18
Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution
Affected: 5.10.0 before 5.10.0.296; 5.11.0 before 5.11.0.336; 6.0.0 before 6.0.0.188; 6.1.0 before 6.1.0.148; 7.0.0 before 7.0.0.15
CVE-2024-2374
9.1
0%
Apr 16
XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service
Affected: 5.10.0 before 5.10.0.300; 5.11.0 before 5.11.0.329; 6.0.0 before 6.0.0.179; 6.1.0 before 6.1.0.136
CVE-2025-10713
9.1
0%
Nov 5
XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration
Affected: 5.10.0 before 5.10.0.373; 5.11.0 before 5.11.0.417; 7.1.0 before 7.1.0.29
Showing 7