OS
Vendor
OSGeo
62
CVEs
3
On KEV
0
New 30D
Products
GE9.8
GeoServer
OSGeo
18 CVEs2 on KEV0 new
JA10.0
JAI-EXT
OSGeo
1 CVEs1 on KEV0 new
MA9.8
Mapserver
Osgeo
22 CVEs0 on KEV0 new
GD9.8
gdal
OSGeo
13 CVEs0 on KEV0 new
GE9.1
Geonetwork
Osgeo
4 CVEs0 on KEV0 new
OW7.5
Owslib
Osgeo
2 CVEs0 on KEV0 new
PY7.5
Pywps
Osgeo
1 CVEs0 on KEV0 new
SH9.8
Shapelib
Osgeo
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-58175 | GE Geoserver Osgeo | 8.2 | Jun 18 | GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution |
| CVE-2025-52465 | GE Geoserver Osgeo | 7.2 | Jun 18 | GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page |
| CVE-2025-27511 | GE Geoserver Osgeo | 7.2 | Jun 18 | GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection |
| CVE-2026-45104 | MA Mapserver Osgeo | 7.5 | May 27 | MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY` |
| CVE-2026-49014 | GD Gdal Osgeo | 7.8 | May 27 | In GDAL 3.1.0 through 3.13.0, scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflow |
| CVE-2026-8213 | GD gdal OSGeo | 5.5 | May 9 | OSGeo gdal Grid File GDapi.c GDSDfldsrch heap-based overflow |
| CVE-2026-8212 | GD gdal OSGeo | 5.5 | May 9 | OSGeo gdal SWapi.c SWSDfldsrch heap-based overflow |
| CVE-2026-42030 | MA Mapserver Osgeo | 6.1 | May 8 | MapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewer |
| CVE-2026-8088 | GD gdal OSGeo | 5.5 | May 7 | OSGeo gdal GDapi.c GDfieldinfo out-of-bounds |
| CVE-2026-8087 | GD gdal OSGeo | 7.8 | May 7 | OSGeo gdal GDapi.c GDnentries heap-based overflow |
| CVE-2026-8086 | GD gdal OSGeo | 7.8 | May 7 | OSGeo gdal SWapi.c SWnentries heap-based overflow |
| CVE-2026-8084 | GD gdal OSGeo | 5.5 | May 7 | OSGeo gdal HDF-EOS Grid File SWapi.c memmove out-of-bounds |
| CVE-2026-33721 | MA Mapserver Osgeo | 7.5 | Mar 27 | MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing |
| CVE-2026-4738 | GD gdal OSGeo | 9.4 | Mar 24 | GDAL Bundled zlib (inftree9.c) Pointer Offset Optimization Undefined Behavior Allows Heap Corruption or Remote Code Execution |
| CVE-2022-50899 | GE Geonetwork Osgeo | 6.5 | Jan 13 | Geonetwork 3.10 through 4.2.0 contains an XML external entity vulnerability in PDF rendering that allows attackers to retrieve arbitrary files from the server |
| CVE-2025-58360 In wildKEV | GE GeoServer OSGeo | 9.8 | Nov 25 | GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature |
| CVE-2025-59431 | MA Mapserver Osgeo | 9.8 | Sep 19 | MapServer is a system for developing web-based GIS applications |
| CVE-2025-30220 | GE Geoserver Osgeo | 9.1 | Jun 10 | GeoServer is an open source server that allows users to share and edit geospatial data |
| CVE-2025-30145 | GE Geoserver Osgeo | 7.5 | Jun 10 | GeoServer is an open source server that allows users to share and edit geospatial data |
| CVE-2025-27505 | GE Geoserver Osgeo | 5.3 | Jun 10 | GeoServer is an open source server that allows users to share and edit geospatial data |
| CVE-2024-40625 | GE Geoserver Osgeo | 4.9 | Jun 10 | GeoServer is an open source server that allows users to share and edit geospatial data |
| CVE-2024-38524 | GE Geoserver Osgeo | 7.5 | Jun 10 | GeoServer is an open source server that allows users to share and edit geospatial data |
| CVE-2024-34711 | GE Geoserver Osgeo | 8.2 | Jun 10 | GeoServer is an open source server that allows users to share and edit geospatial data |
| CVE-2024-29198 | GE Geoserver Osgeo | 8.2 | Jun 10 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data |
| CVE-2025-29480 | GD Gdal Osgeo | 5.5 | Apr 7 | Buffer Overflow vulnerability in gdal 3.10.2 allows a local attacker to cause a denial of service via the OGRSpatialReference::Release function |
| CVE-2024-32037 | GE Geonetwork Osgeo | 5.3 | Feb 11 | GeoNetwork is a catalog application to manage spatially referenced resources |
| CVE-2024-35230 | GE Geoserver Osgeo | 5.3 | Dec 16 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data |
| CVE-2024-36401 In wildKEV | GE GeoServer OSGeo | 9.8 | Jul 1 | Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver |
| CVE-2023-43795 | GE Geoserver Osgeo | 9.8 | Oct 25 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data |
| CVE-2023-41339 | GE Geoserver Osgeo | 5.3 | Oct 25 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data |
| CVE-2023-27476 | OW Owslib Osgeo | 7.5 | Mar 8 | OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models |
| CVE-2023-25157 | GE Geoserver Osgeo | 9.8 | Feb 21 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data |
| CVE-2022-0699 | SH Shapelib Osgeo | 9.8 | Oct 17 | A double-free condition exists in contrib/shpsort.c of shapelib 1.5.0 and older releases |
| CVE-2021-28398 | GE Geonetwork Osgeo | 7.2 | Sep 5 | A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to execute arbitrary OS commands remotely on the hosting… |
| CVE-2021-40822 | GE Geoserver Osgeo | 7.5 | May 2 | GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host |
| CVE-2022-24847 | GE Geoserver Osgeo | 7.2 | Apr 13 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data |
| CVE-2022-24816 In wildKEV | JA JAI-EXT OSGeo | 10.0 | Apr 13 | Improper Control of Generation of Code in jai-ext |
| CVE-2021-45943 | GD Gdal Osgeo | 5.5 | Jan 1 | GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called from PCIDSK::CPCIDSKSegment::ReadFromFile and… |
| CVE-2021-39371 | PY Pywps Osgeo | 7.5 | Aug 23 | An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the entity |
| CVE-2019-25050 | GD Gdal Osgeo | 7.8 | Jul 20 | netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4_get_att (called from nc4_get_att_tc and nc_get_att_text) and in uffd_cleanup (called from… |
| CVE-2021-32062 | MA Mapserver Osgeo | 5.3 | May 6 | MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MS_MAP_NO_PATH and… |
| CVE-2010-1678 | MA Mapserver Osgeo | 7.5 | Oct 29 | Mapserver 5.2, 5.4 and 5.6 before 5.6.5-2 improperly validates symbol index values during Mapfile parsing |
| CVE-2019-17546 | GD Gdal Osgeo | 8.8 | Oct 14 | tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a… |
| CVE-2019-17545 | GD Gdal Osgeo | 9.8 | Oct 14 | GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded |
| CVE-2017-5522 | MA Mapserver Osgeo | 9.8 | Mar 15 | Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash)… |
| CVE-2016-9839 | MA Mapserver Osgeo | 7.5 | Dec 8 | In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails |
| CVE-2013-7262 | MA Mapserver Osgeo | – | Jan 5 | SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to… |
| CVE-2011-2975 | MA Mapserver Osgeo | – | Aug 1 | Double free vulnerability in the msAddImageSymbol function in mapsymbol.c in MapServer before 6.0.1 might allow remote attackers to cause a denial of service (application crash)… |
| CVE-2011-2704 | MA Mapserver Osgeo | – | Aug 1 | Stack-based buffer overflow in MapServer before 4.10.7 and 5.x before 5.6.7 allows remote attackers to execute arbitrary code via vectors related to OGC filter encoding |
| CVE-2011-2703 | MA Mapserver Osgeo | – | Aug 1 | Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via vectors… |
| CVE-2010-2540 | MA Mapserver Osgeo | – | Aug 2 | mapserv.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 does not properly restrict the use of CGI command-line arguments that were intended for debugging, which… |
| CVE-2010-2539 | MA Mapserver Osgeo | – | Aug 2 | Buffer overflow in the msTmpFile function in maputil.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 allows local users to cause a denial of service via vectors… |
| CVE-2009-2281 | MA Mapserver Osgeo | – | Oct 23 | Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x through 4.10.4 and 5.x before 5.4.2 allow remote attackers to execute… |
| CVE-2009-1177 | MA Mapserver Osgeo | – | Mar 31 | Multiple stack-based buffer overflows in maptemplate.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 have unknown impact and remote attack vectors |
| CVE-2009-1176 | MA Mapserver Osgeo | – | Mar 31 | mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id parameter ends in a '\0' character, which allows remote… |
| CVE-2009-0843 | MA Mapserver Osgeo | – | Mar 31 | The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname… |
| CVE-2009-0842 | MA Mapserver Osgeo | – | Mar 31 | mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to read arbitrary invalid .map files via a full pathname in the map parameter, which triggers… |
| CVE-2009-0841 | MA Mapserver Osgeo | – | Mar 31 | Directory traversal vulnerability in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when running on Windows with Cygwin, allows remote attackers to… |
| CVE-2009-0840 | MA Mapserver Osgeo | – | Mar 31 | Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to have an unknown… |
| CVE-2009-0839 | MA Mapserver Osgeo | – | Mar 31 | Stack-based buffer overflow in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when the server has a map with a long IMAGEPATH or NAME attribute, allows… |