WSO2 WSO2 Carbon API Management API

• CVE-2026-3418 Critical 9.1 Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution 0.8%
• CVE-2025-4760 Medium 4.8 Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher 0.2%