GeoServer geoserver

• CVE-2025-58360 High 8.2 Exploited GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature 61.2%
• CVE-2024-36401 Critical 9.8 Exploited Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver 99.8%
• CVE-2025-21621 Medium 6.1 GeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format 0.3%
• CVE-2025-30220 Critical 9.9 GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling 43.6%
• CVE-2025-30145 High 7.5 GeoServer has an Infinite Loop Vulnerability in Jiffle process 0.5%
• CVE-2025-27505 Medium 5.3 GeoServer Missing Authorization on REST API Index 1.2%
• CVE-2024-40625 Medium 5.5 GeoServer Coverage REST API Allows Server Side Request Forgery 0.4%
• CVE-2024-38524 Medium 5.3 GWC Home Page communicate version and revision information 0.5%
• CVE-2024-34711 Critical 9.3 GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF) 0.3%
• CVE-2024-29198 High 7.5 GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost 2.3%
• CVE-2024-35230 Medium 5.3 Welcome and About GeoServer pages communicate version and revision information 0.7%
• CVE-2024-34696 Medium 4.5 GeoServer's Server Status shows sensitive environmental variables and Java properties 0.4%
• CVE-2024-24749 High 7.5 Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat 0.8%
• CVE-2024-23821 Medium 4.8 GeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS) 0.4%
• CVE-2024-23819 Medium 4.8 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in MapML HTML Page 0.4%
• CVE-2024-23818 Medium 4.8 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers Format 0.4%
• CVE-2024-23643 Medium 4.8 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in GWC Seed Form 0.4%
• CVE-2024-23642 Medium 4.8 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG Renderer 0.4%
• CVE-2024-23640 Medium 4.8 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Style Publisher 0.4%
• CVE-2024-23634 Medium 6.0 GeoServer arbitrary file renaming vulnerability in REST Coverage/Data Store API 0.7%
• CVE-2023-51445 Medium 4.8 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in REST Resources API 0.5%
• CVE-2023-51444 High 7.2 GeoServer arbitrary file upload vulnerability in REST Coverage Store API 1.9%
• CVE-2023-41877 High 7.2 GeoServer log file path traversal vulnerability 0.8%
• CVE-2023-43795 High 8.6 WPS Server Side Request Forgery in GeoServer 69.0%
• CVE-2023-41339 High 8.6 Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer 0.6%
• CVE-2023-25157 Critical 9.8 Unfiltered SQL Injection Vulnerabilities in Geoserver 85.2%
• CVE-2022-24847 High 7.2 Improper Input Validation in GeoServer 1.6%