WSO2 WSO2 Carbon API Gateway

• CVE-2026-3415 High 8.7 XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service 0.5%
• CVE-2025-8154 Medium 5.3 HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation 0.2%