geoserver vulnerabilities
31 published CVEs name geoserver among the affected products; CISA lists 2 of them as exploited in the wild.
- 31Published CVEs31 of them scored
- 5Last 12 monthspublished in the last year
- 4Critical11 more rated high
- 2Known exploitedin CISA's KEV catalog
Known exploited
Newest addition to KEV first.
- CVE-2025-58360
GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
geoserver · geoserver
ExploitedHigh8.2 - CVE-2024-36401
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
geoserver · geoserver
ExploitedCritical9.8