Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 405,475All CVEsplus 19,160 rejected
- 611Last 24 hours4,916 in the last 7 days
- 18,814Last 30 days1,594 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 9 | 17 | 50 | 8 | 0 | 84 | 129 |
| 2025 | 6 | 3 | 28 | 2 | 0 | 39 | 45 |
| 2024 | 0 | 0 | 0 | 0 | 0 | 0 | 6 |
| 2023 | 0 | 1 | 5 | 0 | 0 | 6 | 6 |
| Title | ||
|---|---|---|
| CVE-2025-11229 | Privilege Escalation via Client Credentials Grant Type in WSO2 Identity ServerWSO2 · WSO2 Identity Server | High7.2 |
| CVE-2026-4052 | Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)WSO2 · WSO2 API Manager | Critical9.8 |
| CVE-2025-5769 | Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI ModificationWSO2 · WSO2 API Control Plane | Medium6.1 |
| CVE-2025-1397 | Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity ProvidersWSO2 · WSO2 Universal Gateway | Medium4.8 |
| CVE-2024-12139 | Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering AttacksWSO2 · WSO2 API Manager | Medium4.3 |
| CVE-2024-12141 | Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing AttacksWSO2 · WSO2 Identity Server | Medium4.3 |
| CVE-2024-9517 | Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked AccountsWSO2 · WSO2 API Manager | Medium4.9 |
| CVE-2024-2372 | Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing AttacksWSO2 · WSO2 Open Banking AM | Medium5.4 |
| CVE-2025-12544 | Stored Cross-Site Scripting in Multiple WSO2 ProductsWSO2 · WSO2 API Manager | Medium4.8 |
| CVE-2026-2613 | SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service DisruptionWSO2 · WSO2 API Manager | High8.7 |
| CVE-2026-18800 | Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive DataWSO2 · WSO2 API Manager | Medium4.4 |
| CVE-2025-13647 | Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File PathsWSO2 · WSO2 Identity Server | Medium5.8 |
| CVE-2024-7075 | Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 ProductsWSO2 · WSO2 Enterprise Integrator | Medium4.6 |
| CVE-2024-5617 | Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force AttacksWSO2 · WSO2 API Manager | Medium4.8 |
| CVE-2025-11969 | Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative ActionsWSO2 · WSO2 API Manager | Critical9.4 |
| CVE-2026-78674 | Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command ExecutionWSO2 · Enterprise Integrator (BPS profile) | High8.8 |
| CVE-2026-6647 | Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle EventsWSO2 · WSO2 Identity Server | High7.4 |
| CVE-2026-3583 | Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]WSO2 · WSO2 API Manager | Low3.1 |
| CVE-2026-11854 | Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 ProductsWSO2 · WSO2 API Manager | Medium6.1 |
| CVE-2025-14260 | Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External ResourcesWSO2 · WSO2 API Manager | High8.3 |
| CVE-2024-6423 | Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information LeakageWSO2 · WSO2 API Manager | Medium4.0 |
| CVE-2025-0326 | Improper Token Revocation in WSO2 Identity Server Allows Unauthorized AccessWSO2 · WSO2 Identity Server | High7.4 |
| CVE-2024-7478 | Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account DiscoveryWSO2 · WSO2 API Manager | Medium5.8 |
| CVE-2024-5563 | Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force AttacksWSO2 · WSO2 Identity Server | Medium4.8 |
| CVE-2024-4989 | Open Redirection via Callback URL in WSO2 API Manager Allows Phishing AttacksWSO2 · WSO2 API Manager | Medium5.4 |
| CVE-2024-5139 | Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and RedirectionWSO2 · WSO2 Enterprise Integrator | Medium6.1 |
| CVE-2024-2323 | Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account DiscoveryWSO2 · WSO2 Enterprise Integrator | Medium4.8 |
| CVE-2024-4412 | Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary OperationsWSO2 · WSO2 Enterprise Integrator | Low2.7 |
| CVE-2025-13173 | Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session TerminationWSO2 · WSO2 API Control Plane | Medium6.5 |
| CVE-2025-13591 | Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account DiscoveryWSO2 · WSO2 Identity Server | Medium5.3 |
| CVE-2025-10149 | Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account TakeoverWSO2 · WSO2 Identity Server as Key Manager | High8.2 |
| CVE-2025-7203 | Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of CredentialsWSO2 · WSO2 Universal Gateway | Medium4.9 |
| CVE-2025-7043 | Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource ConsumptionWSO2 · WSO2 API Manager | Medium5.4 |
| CVE-2025-6623 | Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and RedirectionWSO2 · WSO2 API Manager | Medium4.3 |
| CVE-2024-4457 | Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code ExecutionWSO2 · WSO2 Enterprise Integrator | Critical9.1 |
| CVE-2024-8122 | Potential brute force vulnerability due to non-expiring SMS OTPsWSO2 · WSO2 Identity Server | Medium5.9 |
| CVE-2025-13166 | Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account DiscoveryWSO2 · WSO2 Identity Server | Low3.7 |
| CVE-2025-5802 | Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account DiscoveryWSO2 · WSO2 API Manager | Medium5.3 |
| CVE-2026-19515 | OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command ExecutionWSO2 · WSO2 Integrator: MI for Visual Studio Code | High7.0 |
| CVE-2026-4103 | Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script ExecutionWSO2 · WSO2 API Control Plane | Medium6.4 |
| CVE-2026-3096 | Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential TheftWSO2 · WSO2 API Control Plane | Medium4.7 |
| CVE-2025-12737 | Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code ExecutionWSO2 · WSO2 Open Banking AM | High8.4 |
| CVE-2026-3416 | Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event PayloadsWSO2 · WSO2 API Manager | Medium5.9 |
| CVE-2026-3418 | Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code ExecutionWSO2 · WSO2 API Manager | Critical9.1 |
| CVE-2026-3415 | XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of ServiceWSO2 · WSO2 API Manager | High8.7 |
| CVE-2025-14561 | Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant OperationsWSO2 · WSO2 API Manager | Critical9.0 |
| CVE-2025-12317 | Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access PrivilegesWSO2 · WSO2 Enterprise Integrator | Medium5.0 |
| CVE-2025-6508 | User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended RequestsWSO2 · WSO2 API Manager | Medium4.3 |
| CVE-2024-6541 | Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 ProductsWSO2 · WSO2 Micro Integrator | Medium6.8 |
| CVE-2026-5430 | Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account TakeoverExploitedPublic exploitWSO2 · WSO2 Universal Gateway | Critical10.0 |