What’s Vulnerable › Products

geoserver org.geoserver.extension:gs-db2 vulnerabilities

16 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your geoserver org.geoserver.extension:gs-db2 version is affected

Latest geoserver org.geoserver.extension:gs-db2 vulnerabilities

• CVE-2025-58175 — GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution (CVSS 8.2)
• CVE-2025-52465 — GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page (CVSS 7.2)
• CVE-2025-27511 — GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection (CVSS 7.2)
• CVE-2025-30220 — GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling (CVSS 9.1)
• CVE-2025-30145 — GeoServer has an Infinite Loop Vulnerability in Jiffle process (CVSS 7.5)
• CVE-2025-27505 — GeoServer Missing Authorization on REST API Index (CVSS 5.3)
• CVE-2024-40625 — GeoServer Coverage REST API Allows Server Side Request Forgery (CVSS 4.9)
• CVE-2024-38524 — GWC Home Page communicate version and revision information (CVSS 7.5)
• CVE-2024-34711 — GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF) (CVSS 8.2)
• CVE-2024-29198 — GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost (CVSS 8.2)
• CVE-2024-35230 — Welcome and About GeoServer pages communicate version and revision information (CVSS 5.3)
• CVE-2023-43795 — WPS Server Side Request Forgery in GeoServer (CVSS 9.8)
• CVE-2023-41339 — Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer (CVSS 5.3)
• CVE-2023-25157 — Unfiltered SQL Injection Vulnerabilities in Geoserver (CVSS 9.8)
• CVE-2021-40822 — (CVSS 7.5)
• CVE-2022-24847 — Improper Input Validation in GeoServer (CVSS 7.2)