Wso2 api control plane

This hub aggregates every CVE we track for Wso2 api control plane, a product in the cloud saas space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Wso2 api control plane.

• CVE-2026-3418Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution9.1Aug 6, 2026
• CVE-2026-3415XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service8.7Aug 6, 2026
• CVE-2025-14561Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations9.0Aug 6, 2026
• CVE-2026-5430Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover10.0Aug 6, 2026
• CVE-2026-1728Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover9.8Aug 6, 2026
• CVE-2025-15039Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products9.4Aug 6, 2026
• CVE-2026-0637Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products4.4Aug 6, 2026
• CVE-2025-13394Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions5.4Aug 6, 2026
• CVE-2024-10302Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure4.0Aug 6, 2026
• CVE-2024-6832Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks5.9Aug 6, 2026
• CVE-2024-8995Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access4.9Aug 6, 2026
• CVE-2026-2445Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification6.1Jul 20, 2026
• CVE-2026-4249Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption8.6Jul 6, 2026
• CVE-2025-8591Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification6.1Jul 6, 2026
• CVE-2025-8325Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations6.3May 11, 2026