Wso2 api manager

This hub aggregates every CVE we track for Wso2 api manager, a product in the cloud saas space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Wso2 api manager.

• CVE-2025-5802Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery5.3Sep 15, 2026
• CVE-2026-4103Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution6.4Sep 14, 2026
• CVE-2026-3096Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft4.7Sep 10, 2026
• CVE-2025-12737Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution8.4Sep 3, 2026
• CVE-2026-3416Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads5.9Sep 3, 2026
• CVE-2026-3418Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution9.1Aug 6, 2026
• CVE-2026-3415XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service8.7Aug 6, 2026
• CVE-2025-14561Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations9.0Aug 6, 2026
• CVE-2025-6508User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requests4.3Aug 6, 2026
• CVE-2024-6541Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products6.8Aug 6, 2026
• CVE-2026-5430Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover10.0Aug 6, 2026
• CVE-2026-1728Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover9.8Aug 6, 2026
• CVE-2025-15039Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products9.4Aug 6, 2026
• CVE-2026-0637Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products4.4Aug 6, 2026
• CVE-2025-13394Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions5.4Aug 6, 2026