Log in Start free

GeoServer

Products

ProductCVEsExploitedLatest
geoserver272Nov 25, 2025
org.geoserver.web:gs-web-app2–Jun 18, 2026
GeoWebCache1–Oct 26, 2023
org.geoserver.extension:gs-db21–Jun 18, 2026
org.geoserver.web:gs-web-sec-core1–Jun 18, 2026
org.geoserver:gs-main1–Jun 18, 2026

Exploited and recent CVEs

  • CVE-2025-58360 High 8.2 Exploited GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature 61.2%
  • CVE-2024-36401 Critical 9.8 Exploited Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver 99.8%
  • CVE-2025-58175 Medium 6.5 GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution 0.3%
  • CVE-2025-58175 Medium 6.5 GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution 0.3%
  • CVE-2025-52465 High 7.2 GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page 0.6%
  • CVE-2025-52465 High 7.2 GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page 0.6%
  • CVE-2025-27511 High 7.2 GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection 1.1%
  • CVE-2025-21621 Medium 6.1 GeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format 0.3%
  • CVE-2025-30220 Critical 9.9 GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling 43.6%
  • CVE-2025-30145 High 7.5 GeoServer has an Infinite Loop Vulnerability in Jiffle process 0.5%
  • CVE-2025-27505 Medium 5.3 GeoServer Missing Authorization on REST API Index 1.2%
  • CVE-2024-40625 Medium 5.5 GeoServer Coverage REST API Allows Server Side Request Forgery 0.4%
  • CVE-2024-38524 Medium 5.3 GWC Home Page communicate version and revision information 0.5%
  • CVE-2024-34711 Critical 9.3 GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF) 0.3%
  • CVE-2024-29198 High 7.5 GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost 2.3%
  • CVE-2024-35230 Medium 5.3 Welcome and About GeoServer pages communicate version and revision information 0.7%
  • CVE-2024-34696 Medium 4.5 GeoServer's Server Status shows sensitive environmental variables and Java properties 0.4%
  • CVE-2024-24749 High 7.5 Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat 0.8%
  • CVE-2024-23821 Medium 4.8 GeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS) 0.4%
  • CVE-2024-23819 Medium 4.8 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in MapML HTML Page 0.4%
  • CVE-2024-23818 Medium 4.8 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers Format 0.4%
  • CVE-2024-23643 Medium 4.8 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in GWC Seed Form 0.4%
  • CVE-2024-23642 Medium 4.8 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG Renderer 0.4%
  • CVE-2024-23640 Medium 4.8 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Style Publisher 0.4%
  • CVE-2024-23634 Medium 6.0 GeoServer arbitrary file renaming vulnerability in REST Coverage/Data Store API 0.7%
  • CVE-2023-51445 Medium 4.8 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in REST Resources API 0.5%
  • CVE-2023-51444 High 7.2 GeoServer arbitrary file upload vulnerability in REST Coverage Store API 1.9%
  • CVE-2023-41877 High 7.2 GeoServer log file path traversal vulnerability 0.8%
  • CVE-2023-5786 Medium 5.3 GeoServer GeoWebCache rest.html direct request 1.0%
  • CVE-2023-43795 High 8.6 WPS Server Side Request Forgery in GeoServer 69.0%