CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,436 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,436
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product wso2:traffic_manager. Show all products

31 CVEs, showing 1 to 31
CVESeverityTitlePublished
CVE-2024-8008Medium 5.2Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation
Assigned by WSO2
Jun 2, 2025
CVE-2025-4760Medium 4.8An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal.Sep 23, 2025
CVE-2025-5717High 7.2An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service.Sep 23, 2025
CVE-2025-10611Critical 9.8Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without prop…Oct 16, 2025
CVE-2025-9804Medium 6.5An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs.Oct 16, 2025
CVE-2025-5350Medium 4.8SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users.Oct 24, 2025
CVE-2025-5605Medium 5.3An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products.Oct 24, 2025
CVE-2025-3125High 7.2An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint.Nov 5, 2025
CVE-2025-10713Critical 9.1An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser.Nov 5, 2025
CVE-2025-10907High 7.2An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services.Nov 5, 2025
CVE-2025-11093High 7.2An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines.Nov 5, 2025
CVE-2025-10853Medium 6.1A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding.Nov 5, 2025
CVE-2025-6670High 8.8A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event…Nov 18, 2025
CVE-2025-9312Critical 9.8A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products.Nov 18, 2025
CVE-2025-13590High 7.2A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API.Feb 19, 2026
CVE-2025-8154High 7.5In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses.May 11, 2026
CVE-2025-8325High 8.8The software fails to enforce role-based access controls for certain Gateway API invocations.May 11, 2026
CVE-2025-8591Medium 6.1The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser.Jul 6, 2026
CVE-2026-4249High 8.6The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content.Jul 6, 2026
CVE-2026-5430
Known exploited
Critical 10.0Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
Assigned by WSO2
Aug 6, 2026
CVE-2024-10302Medium 5.8The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input.Aug 6, 2026
CVE-2024-6832High 7.5The account locking mechanism fails to trigger when secondary user stores are inaccessible.Aug 6, 2026
CVE-2024-8995Medium 4.9Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system.Aug 6, 2026
CVE-2025-13394Medium 5.4The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks.Aug 6, 2026
CVE-2025-15039Critical 9.4The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain aut…Aug 6, 2026
CVE-2026-0637Medium 4.4When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties.Aug 6, 2026
CVE-2026-1728Critical 9.8Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs.Aug 6, 2026
CVE-2026-3415High 8.7XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service
Assigned by WSO2
Aug 6, 2026
CVE-2026-3418Critical 9.1Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
Assigned by WSO2
Aug 6, 2026
CVE-2025-12737High 8.4Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution
Assigned by WSO2
Sep 3, 2026
CVE-2025-5802Medium 5.3Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery
Assigned by WSO2
Sep 15, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.