What’s Vulnerable › Products

WSO2 API Manager vulnerabilities

115 known vulnerabilities, 2 confirmed exploited in the wild (CISA KEV), 70 published in the last 12 months.

Check whether your WSO2 API Manager version is affected

Exploited WSO2 API Manager vulnerabilities

• CVE-2026-5430 — WSO2 Multiple Products Path Traversal Vulnerability
• CVE-2022-29464 — WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

Latest WSO2 API Manager vulnerabilities

• CVE-2026-3583 — Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows] (CVSS 3.1)
• CVE-2026-11854 — Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products (CVSS 6.1)
• CVE-2025-14260 — Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources (CVSS 8.3)
• CVE-2024-7478 — Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery (CVSS 5.8)
• CVE-2024-6423 — Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage (CVSS 4.0)
• CVE-2024-5139 — Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection (CVSS 6.1)
• CVE-2024-4989 — Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks (CVSS 5.4)
• CVE-2024-2323 — Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery (CVSS 4.8)
• CVE-2025-7203 — Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials (CVSS 4.9)
• CVE-2025-6623 — Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection (CVSS 4.3)
• CVE-2025-13173 — Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination (CVSS 6.5)
• CVE-2024-4412 — Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations (CVSS 2.7)
• CVE-2025-7043 — Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption (CVSS 5.4)
• CVE-2024-4457 — Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution (CVSS 9.1)
• CVE-2025-5802 — Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery (CVSS 5.3)
• CVE-2026-4103 — Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution (CVSS 6.4)
• CVE-2026-3096 — Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft (CVSS 4.7)
• CVE-2025-12737 — Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution (CVSS 8.4)
• CVE-2026-3416 — Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads (CVSS 7.5)
• CVE-2026-3418 — Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution (CVSS 9.1)
• CVE-2025-6508 — User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requests (CVSS 4.3)
• CVE-2025-14561 — Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations (CVSS 9.0)
• CVE-2024-6541 — Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products (CVSS 6.8)
• CVE-2026-3415 — XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service (CVSS 8.7)
• CVE-2026-5430 — WSO2 Multiple Products Path Traversal Vulnerability (CVSS 10.0) — exploited