Wso2 Api Manager vulnerabilities
95 published vulnerabilities in Wso2 Api Manager, 2 of them exploited in the wild. The most were published in 2025 (26), and 7 so far in 2026.
Wso2 Api Manager vulnerabilities by year
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
Most exploited Wso2 Api Manager vulnerabilities
- CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability
- CVE-2022-29464 WSO2 Multiple Products Unrestrictive Upload of File
- CVE-2026-1728 Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover
- CVE-2025-9312 Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products
- CVE-2025-10611 Potential Broken Access Control in Multiple WSO2 Products via System REST APIs
- CVE-2025-9152 Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint
- CVE-2024-6914 Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover
- CVE-2020-13226 WSO2 API Manager vulnerable to SSRF
- CVE-2025-9804 Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
- CVE-2025-15039 Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
- CVE-2025-13590 Authenticated arbitrary file upload via a System REST API requiring administrator permission.
- CVE-2025-2905 An XML External Entity (XXE) vulnerability in Multiple WSO2 Products
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.