Product by WSO2

    WSO2 Identity Server as Key Manager

    52 known vulnerabilities in WSO2 Identity Server as Key Manager (WSO2), 1 of them actively exploited (CISA KEV).

    Key figures

    52

    Vulnerabilities

    1

    Actively exploited (KEV)

    1

    Used by ransomware

    8

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in WSO2 Identity Server as Key Manager (WSO2)
    CriticalCVE-2022-29464

    WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

    In CISA KEVRansomwarealso in 7 other products

    		9.8
    CriticalCVE-2021-42646

    WSO2 API Manager: XML External Entity (XXE)

    also in 2 other products

    		9.1
    MediumCVE-2020-17453

    WSO2 Identity Server as Key Manager: Cross-Site Scripting (XSS)

    also in 7 other products

    		6.1
    MediumCVE-2022-29548

    WSO2 API Manager: Cross-Site Scripting (XSS)

    also in 8 other products

    		4.6
    CriticalCVE-2025-15039

    Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

    also in 18 other products

    		9.4
    CriticalCVE-2025-10611

    Potential Broken Access Control in Multiple WSO2 Products via System REST APIs

    also in 17 other products

    		9.8
    CriticalCVE-2024-6914

    WSO2 API Manager: Incorrect Authorization

    also in 11 other products

    		9.8
    HighCVE-2020-24705

    WSO2 API Manager: security vulnerability

    also in 5 other products

    		8.8
    HighCVE-2020-24703

    WSO2 Identity Server: security vulnerability

    also in 8 other products

    		8.8
    CriticalCVE-2025-9804

    WSO2 API Manager: Improper Access Control

    also in 24 other products

    		9.6
    HighCVE-2020-12719

    WSO2 API Manager: XML External Entity (XXE)

    also in 6 other products

    		8.7
    HighCVE-2025-12737

    WSO2 Open Banking AM: OS Command Injection

    also in 15 other products

    		8.4
    HighCVE-2025-3125

    WSO2 Identity Server: Unrestricted Upload of File with Dangerous Type

    also in 15 other products

    		6.7
    HighCVE-2025-10907

    WSO2 API Manager: Unrestricted Upload of File with Dangerous Type

    also in 19 other products

    		8.4
    HighCVE-2024-6832

    WSO2 Enterprise Integrator: Protection Mechanism Failure

    also in 17 other products

    		7.5
    CriticalCVE-2025-9312

    Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products

    also in 17 other products

    		9.8
    CriticalCVE-2024-2374

    WSO2 API Manager: Improper Restriction of XML External Entity Reference

    also in 9 other products

    		7.5
    HighCVE-2025-1862

    WSO2 Enterprise Integrator: Unrestricted Upload of File with Dangerous Type

    also in 7 other products

    		6.7
    MediumCVE-2025-5350

    SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products

    also in 18 other products

    		5.9
    MediumCVE-2025-5605

    WSO2 Identity Server: Authentication Bypass

    also in 18 other products

    		4.3
    HighCVE-2023-6837

    WSO2 API Manager: Incorrect Authorization

    also in 6 other products

    		8.5
    HighCVE-2025-6670

    Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services

    also in 16 other products

    		8.8
    MediumCVE-2018-20737

    WSO2 API Manager: Cross-Site Scripting (XSS)

    also in 2 other products

    		5.4
    MediumCVE-2020-14446

    WSO2 Identity Server: Open Redirect

    also in 1 other product

    		6.1
    MediumCVE-2020-24706

    WSO2 API Manager: Cross-Site Scripting (XSS)

    also in 5 other products

    		6.1

    All vulnerabilities in search

    News

    All products by WSO2