WSO2

Products

ProductCVEsExploitedLatest
WSO2 API Manager951Nov 3, 2026
WSO2 API Control Plane511Nov 3, 2026
WSO2 Traffic Manager401Nov 3, 2026
WSO2 Universal Gateway401Nov 3, 2026
WSO2 Carbon API Manager Rest API Utility51Nov 2, 2026
WSO2 Identity Server88–Nov 4, 2026
WSO2 Identity Server as Key Manager54–Nov 3, 2026
WSO2 Open Banking IAM51–Nov 3, 2026
WSO2 Open Banking AM45–Nov 3, 2026
WSO2 Enterprise Integrator29–Nov 2, 2026
WSO2 Carbon OAuth8–Nov 3, 2026
WSO2 Open Banking KM8–Aug 6, 2026
WSO2 Micro Integrator7–Aug 6, 2026
WSO2 Carbon API Management Implementation6–Nov 2, 2026
WSO2 Carbon User Manager Kernel5–Nov 2, 2026
WSO2 Carbon Identity Application Authentication Framework5–Oct 19, 2026
WSO2 Enterprise Mobility Manager4–Oct 16, 2025
org.wso2.carbon:org.wso2.carbon.base3–Nov 5, 2025
WSO2 Carbon Identity User Store Configuration UI3–Oct 19, 2026
WSO2 Carbon MagicLink Authenticator Module3–Aug 6, 2026
org.wso2.carbon:org.wso2.carbon.ui3–Nov 18, 2025
WSO2 Enterprise Service Bus3–Oct 16, 2025
WSO2 IS as Key Manager3–Dec 18, 2023
Email OTP Authenticator3–Oct 19, 2026
WSO2 Carbon Registry Resources UI2–Aug 6, 2026
WSO2 Carbon Identity Management2–Nov 2, 2026
carbon-registry2–Dec 15, 2022
WSO2 API Manager Analytics2–Dec 18, 2023
WSO2 Carbon API Manager Rest API Common Functions2–Nov 2, 2026
WSO2 Identity Server Analytics2–Oct 16, 2025
WSO2 Carbon Abstract OTP Authenticator2–Oct 19, 2026
WSO2 API Microgateway2–Dec 18, 2023
WSO2 Data Analytics Server2–Oct 16, 2025
WSO2 Carbon User Management UI2–Nov 2, 2026
WSO2 Carbon Identity Recovery Management2–Oct 19, 2026
org.wso2.carbon:org.wso2.carbon.server.admin2–Oct 16, 2025
WSO2 Carbon API Management API2–Aug 6, 2026
WSO2 Carbon API Gateway2–Aug 6, 2026
WSO2 Carbon Component Andes Event UI1–Aug 6, 2026
WSO2 Carbon Component Andes UI11–Aug 6, 2026
WSO2 Carbon Email Verification UI1–Aug 6, 2026
WSO2 Carbon Endpoint Editor UI1–Aug 6, 2026
WSO2 Carbon Event Publisher Core1–Nov 2, 2026
WSO2 Carbon Event Publisher UI1–Oct 19, 2026
WSO2 Carbon Event Receiver UI1–Oct 19, 2026
WSO2 Carbon Event Simulator UI1–Aug 6, 2026
WSO2 Carbon Eventing UI1–Aug 6, 2026
WSO2 Carbon Execution Manager UI1–Aug 6, 2026
WSO2 Carbon Governance1–Aug 6, 2026
WSO2 Carbon Governance Custom Lifecycle Checklist UI1–Aug 6, 2026
WSO2 Carbon Governance Generic Artifact User Interface1–Aug 6, 2026
WSO2 Carbon Governance Life Cycles User Interface1–Aug 6, 2026
WSO2 Carbon Governance WSDL Tool UI1–Aug 6, 2026
WSO2 Carbon HL7 Business Messaging Store UI1–Aug 6, 2026
WSO2 Carbon HumanTask UI1–Aug 6, 2026
WSO2 Carbon Identity API Server Configs V11–Oct 19, 2026
WSO2 Carbon Identity API Server Secret Management Common1–Aug 6, 2026
WSO2 Carbon Identity API Server Secret Management V11–Aug 6, 2026
WSO2 Carbon Identity Application1–Oct 21, 2026
WSO2 Carbon Identity Application Authentication Endpoint(Utils)1–Jun 2, 2025
WSO2 Carbon Identity Client Attestation Met Data Mgt BE1–May 22, 2025
WSO2 Carbon Identity Core1–Oct 21, 2026
WSO2 Carbon Identity Entitlement UI1–Aug 6, 2026
WSO2 Carbon Identity Management Endpoint Util1–Sep 15, 2026
WSO2 Carbon Identity Management UI11–Aug 6, 2026
WSO2 Carbon Identity Oauth1–Oct 21, 2026
WSO2 Carbon Identity User Store1–Oct 19, 2026
WSO2 Carbon Identity User Store Configuration1–Oct 19, 2026
WSO2 Carbon Logging Services1–Oct 19, 2026
WSO2 Carbon Logging UI1–Aug 6, 2026
API Manager Analytics1–Oct 16, 2025
WSO2 Carbon Policy Editor BE1–Jun 2, 2025
WSO2 Carbon Publish Event Mediator Configuration UI1–Aug 6, 2026
WSO2 Carbon Registry Indexing1–Aug 6, 2026
WSO2 Carbon Registry Info UI21–Aug 6, 2026
WSO2 Carbon Registry Kernel1–Nov 2, 2026
WSO2 Carbon Registry Profiles UI1–Aug 6, 2026
WSO2 Carbon Registry Properties UI1–Aug 6, 2026
WSO2 Carbon Registry Relations UI1–Aug 6, 2026
WSO2 Carbon Registry Search UI1–Aug 6, 2026
WSO2 Carbon Rest API Admin UI1–Aug 6, 2026
WSO2 Carbon Rule Mediator UI1–Aug 6, 2026
WSO2 Carbon SCIM 2.0 Common Component1–Oct 19, 2026
WSO2 Carbon SCIM Common Component1–Oct 19, 2026
WSO2 Carbon Secured HTTP Log4j2 Appender1–Oct 19, 2026
WSO2 Carbon Security UI1–Aug 6, 2026
WSO2 Carbon Sequence Editor UI1–Aug 6, 2026
WSO2 Carbon Synapse Artifact Uploader BE1–Jun 2, 2025
WSO2 Carbon Task UI1–Aug 6, 2026
WSO2 Carbon Tasks Core1–Aug 6, 2026
WSO2 Carbon Template Editor UI1–Aug 6, 2026
WSO2 Carbon Throttle Mediator UI1–Aug 6, 2026
WSO2 Carbon UI1–Oct 28, 2026
WSO2 Carborn Identity Handler1–Oct 21, 2026
WSO2 Enterprise Service Bus Analytics1–Oct 16, 2025
WSO2 Governance Registry1–May 22, 2025
WSO2 Identity Application Management Component1–Nov 4, 2026
WSO2 Identity Server Key Manager Connector (apim-km-wso2is)1–Nov 3, 2026
WSO2 Identity Server Keystore Rest API Commons1–Nov 2, 2026
WSO2 Identity Server Keystore Rest API V11–Nov 2, 2026
WSO2 Integrator: MI for Visual Studio Code1–Sep 15, 2026
WSO2 IoT1–May 22, 2025
WSO2 IoT Server1–Dec 15, 2023
WSO2 Message Broker1–Dec 18, 2023
WSO2 Stratos SSO Redirector UI Component1–Aug 6, 2026
WSO2 Stratos User Interface For Tenant CRUD Operations1–Aug 6, 2026
WSO2-Synapse1–Aug 6, 2026
WSO2 Carbon New Data Sources UI1–Aug 6, 2026
Business Process Server1–Oct 28, 2026
Client Attestation Filter1–May 22, 2025
Conditional Authentication User and Roles Related Functions1–May 11, 2026
Enterprise Integrator (BPS profile)1–Oct 28, 2026
Forgerock Key Manager Component1–Oct 19, 2026
Identity Server1–Feb 19, 2026
JWT Grant Type For OAuth21–Nov 3, 2026
org.apache.synapse:synapse-core1–Nov 5, 2025
org.apache.synapse:synapse-extensions1–Nov 5, 2025
org.apache.ws.commons.axiom.wso2:axiom1–Nov 5, 2025
org.jaggeryjs:org.jaggeryjs.jaggery.app.mgt1–Nov 5, 2025
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl1–Feb 19, 2026
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util1–Oct 16, 2025
org.wso2.carbon.commons:org.wso2.carbon.application.upload1–Nov 5, 2025
org.wso2.carbon.deployment:org.wso2.carbon.module.mgt1–Nov 5, 2025
org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt1–Nov 5, 2025
org.wso2.carbon.event-processing:org.wso2.carbon.event.simulator.core1–Nov 5, 2025
org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector1–Oct 16, 2025
org.wso2.carbon.governance:org.wso2.carbon.governance.wsdltool.ui1–Nov 5, 2025
org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service1–Oct 16, 2025
org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve1–Oct 16, 2025
org.wso2.carbon.identity.auth.service1–Nov 18, 2025
org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt1–Oct 16, 2025
org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth.ui1–Nov 5, 2025
org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow1–Oct 16, 2025
org.wso2.carbon.mediation:org.wso2.carbon.localentry1–Nov 5, 2025
org.wso2.carbon.mediation:org.wso2.carbon.mediation.library1–Nov 5, 2025
org.wso2.carbon.registry:org.wso2.carbon.registry.info.ui1–Nov 5, 2025
org.wso2.carbon.registry:org.wso2.carbon.registry.resource.ui1–Nov 5, 2025
org.wso2.carbon:org.wso2.carbon.utils1–Nov 5, 2025
SAML2 SSO Authenticator UI Bundle1–Oct 28, 2026
Siddhi Extension Evaluate Scripts1–Sep 23, 2025
Token Exchange Grant Type For OAuth1–Aug 6, 2026
WSO2 API Manager Publisher REST API V41–Aug 6, 2026
WSO2 Carbon API Manager Publisher REST API1–Nov 2, 2026
WSO2 Carbon Authenticator Library For EmailOTP1–May 11, 2026
WSO2 Carbon Command Mediator UI1–Aug 6, 2026

Exploited and recent CVEs

  • CVE-2026-5430 Critical 10.0 Exploited Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover 22.4%
  • CVE-2026-5430 Critical 10.0 Exploited Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover 22.4%
  • CVE-2026-5430 Critical 10.0 Exploited Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover 22.4%
  • CVE-2026-5430 Critical 10.0 Exploited Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover 22.4%
  • CVE-2026-5430 Critical 10.0 Exploited Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover 22.4%
  • CVE-2025-11229 High 7.2 Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server 0.4%
  • CVE-2025-11229 High 7.2 Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server 0.4%
  • CVE-2026-4052 Critical 9.8 Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager) 0.4%
  • CVE-2026-4052 Critical 9.8 Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager) 0.4%
  • CVE-2026-4052 Critical 9.8 Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager) 0.4%
  • CVE-2025-5769 Medium 6.1 Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modification 0.2%
  • CVE-2025-5769 Medium 6.1 Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modification 0.2%
  • CVE-2025-5769 Medium 6.1 Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modification 0.2%
  • CVE-2025-1397 Medium 4.8 Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers 0.2%
  • CVE-2025-1397 Medium 4.8 Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers 0.2%
  • CVE-2025-1397 Medium 4.8 Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers 0.2%
  • CVE-2025-1397 Medium 4.8 Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers 0.2%
  • CVE-2025-1397 Medium 4.8 Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers 0.2%
  • CVE-2025-1397 Medium 4.8 Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers 0.2%
  • CVE-2025-1397 Medium 4.8 Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers 0.2%
  • CVE-2025-1397 Medium 4.8 Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers 0.2%
  • CVE-2025-1397 Medium 4.8 Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers 0.2%
  • CVE-2025-1397 Medium 4.8 Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers 0.2%
  • CVE-2024-12139 Medium 4.3 Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks 0.2%
  • CVE-2024-12139 Medium 4.3 Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks 0.2%
  • CVE-2024-12139 Medium 4.3 Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks 0.2%
  • CVE-2024-12141 Medium 4.3 Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks 0.2%
  • CVE-2024-9517 Medium 4.9 Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts 0.2%
  • CVE-2024-9517 Medium 4.9 Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts 0.2%
  • CVE-2024-9517 Medium 4.9 Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts 0.2%