WSO2 WSO2 Carbon API Management Implementation

• CVE-2026-2613 High 8.7 SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption 0.4%
• CVE-2026-3418 Critical 9.1 Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution 0.8%
• CVE-2026-3415 High 8.7 XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service 0.5%
• CVE-2025-14561 Critical 9.0 Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations 0.4%
• CVE-2025-8325 Medium 6.3 Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations 0.2%
• CVE-2025-8154 Medium 5.3 HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation 0.2%