agentprime: wso2-api-managerEvery new CVE for wso2-api-manager.https://agentprime.io/CVE-2026-4052: Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)https://agentprime.io/advisories/CVE-2026-4052/https://agentprime.io/advisories/CVE-2026-4052/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 08:02:33 GMTCVEcriticalCVE-2025-5769: Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modificationhttps://agentprime.io/advisories/CVE-2025-5769/https://agentprime.io/advisories/CVE-2025-5769/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 06:11:52 GMTCVECVE-2025-1397: Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providershttps://agentprime.io/advisories/CVE-2025-1397/https://agentprime.io/advisories/CVE-2025-1397/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 06:07:57 GMTCVECVE-2024-12139: Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attackshttps://agentprime.io/advisories/CVE-2024-12139/https://agentprime.io/advisories/CVE-2024-12139/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 17:34:20 GMTCVECVE-2024-9517: Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accountshttps://agentprime.io/advisories/CVE-2024-9517/https://agentprime.io/advisories/CVE-2024-9517/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 11:30:15 GMTCVECVE-2024-2372: Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attackshttps://agentprime.io/advisories/CVE-2024-2372/https://agentprime.io/advisories/CVE-2024-2372/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 11:00:23 GMTCVECVE-2025-12544: Stored Cross-Site Scripting in Multiple WSO2 Productshttps://agentprime.io/advisories/CVE-2025-12544/https://agentprime.io/advisories/CVE-2025-12544/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 10:23:49 GMTCVECVE-2026-2613: SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruptionhttps://agentprime.io/advisories/CVE-2026-2613/https://agentprime.io/advisories/CVE-2026-2613/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 10:11:53 GMTCVECVE-2026-18800: Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Datahttps://agentprime.io/advisories/CVE-2026-18800/https://agentprime.io/advisories/CVE-2026-18800/CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 09:59:26 GMTCVECVE-2024-7075: Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Productshttps://agentprime.io/advisories/CVE-2024-7075/https://agentprime.io/advisories/CVE-2024-7075/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 09:11:32 GMTCVECVE-2024-5617: Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attackshttps://agentprime.io/advisories/CVE-2024-5617/https://agentprime.io/advisories/CVE-2024-5617/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 05:57:28 GMTCVECVE-2025-11969: Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actionshttps://agentprime.io/advisories/CVE-2025-11969/https://agentprime.io/advisories/CVE-2025-11969/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 05:53:51 GMTCVEcriticalCVE-2026-3583: Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]https://agentprime.io/advisories/CVE-2026-3583/https://agentprime.io/advisories/CVE-2026-3583/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 19:21:34 GMTCVECVE-2026-11854: Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Productshttps://agentprime.io/advisories/CVE-2026-11854/https://agentprime.io/advisories/CVE-2026-11854/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 19:21:33 GMTCVECVE-2025-14260: Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resourceshttps://agentprime.io/advisories/CVE-2025-14260/https://agentprime.io/advisories/CVE-2025-14260/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 19:21:32 GMTCVECVE-2024-6423: Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakagehttps://agentprime.io/advisories/CVE-2024-6423/https://agentprime.io/advisories/CVE-2024-6423/CVSS 4.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 13:56:26 GMTCVECVE-2024-7478: Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discoveryhttps://agentprime.io/advisories/CVE-2024-7478/https://agentprime.io/advisories/CVE-2024-7478/CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 13:49:07 GMTCVECVE-2024-4989: Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attackshttps://agentprime.io/advisories/CVE-2024-4989/https://agentprime.io/advisories/CVE-2024-4989/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 13:41:06 GMTCVECVE-2024-5139: Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirectionhttps://agentprime.io/advisories/CVE-2024-5139/https://agentprime.io/advisories/CVE-2024-5139/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 13:36:49 GMTCVECVE-2024-2323: Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discoveryhttps://agentprime.io/advisories/CVE-2024-2323/https://agentprime.io/advisories/CVE-2024-2323/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 07:46:37 GMTCVECVE-2024-4412: Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operationshttps://agentprime.io/advisories/CVE-2024-4412/https://agentprime.io/advisories/CVE-2024-4412/CVSS 2.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 16:59:05 GMTCVECVE-2025-13173: Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Terminationhttps://agentprime.io/advisories/CVE-2025-13173/https://agentprime.io/advisories/CVE-2025-13173/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 16:49:08 GMTCVECVE-2025-7203: Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentialshttps://agentprime.io/advisories/CVE-2025-7203/https://agentprime.io/advisories/CVE-2025-7203/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 16:38:01 GMTCVECVE-2025-7043: Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumptionhttps://agentprime.io/advisories/CVE-2025-7043/https://agentprime.io/advisories/CVE-2025-7043/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 16:28:15 GMTCVECVE-2025-6623: Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirectionhttps://agentprime.io/advisories/CVE-2025-6623/https://agentprime.io/advisories/CVE-2025-6623/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 16:25:50 GMTCVECVE-2024-4457: Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Executionhttps://agentprime.io/advisories/CVE-2024-4457/https://agentprime.io/advisories/CVE-2024-4457/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sun, 18 Oct 2026 18:05:34 GMTCVEcriticalCVE-2025-5802: Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discoveryhttps://agentprime.io/advisories/CVE-2025-5802/https://agentprime.io/advisories/CVE-2025-5802/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 09:53:53 GMTCVECVE-2026-4103: Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Executionhttps://agentprime.io/advisories/CVE-2026-4103/https://agentprime.io/advisories/CVE-2026-4103/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 14 Sep 2026 15:54:05 GMTCVECVE-2026-3096: Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Thefthttps://agentprime.io/advisories/CVE-2026-3096/https://agentprime.io/advisories/CVE-2026-3096/CVSS 4.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 10 Sep 2026 20:40:28 GMTCVECVE-2025-12737: Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Executionhttps://agentprime.io/advisories/CVE-2025-12737/https://agentprime.io/advisories/CVE-2025-12737/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 03 Sep 2026 13:02:26 GMTCVECVE-2026-3416: Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloadshttps://agentprime.io/advisories/CVE-2026-3416/https://agentprime.io/advisories/CVE-2026-3416/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 03 Sep 2026 12:35:32 GMTCVECVE-2026-3418: Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Executionhttps://agentprime.io/advisories/CVE-2026-3418/https://agentprime.io/advisories/CVE-2026-3418/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 17:32:14 GMTCVEcriticalCVE-2026-3415: XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Servicehttps://agentprime.io/advisories/CVE-2026-3415/https://agentprime.io/advisories/CVE-2026-3415/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 17:32:10 GMTCVECVE-2025-14561: Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operationshttps://agentprime.io/advisories/CVE-2025-14561/https://agentprime.io/advisories/CVE-2025-14561/CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 17:32:07 GMTCVEcriticalCVE-2025-6508: User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requestshttps://agentprime.io/advisories/CVE-2025-6508/https://agentprime.io/advisories/CVE-2025-6508/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 17:32:02 GMTCVECVE-2024-6541: Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Productshttps://agentprime.io/advisories/CVE-2024-6541/https://agentprime.io/advisories/CVE-2024-6541/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 17:31:59 GMTCVECVE-2026-5430: Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeoverhttps://agentprime.io/advisories/CVE-2026-5430/https://agentprime.io/advisories/CVE-2026-5430/CVSS 10.0 (Critical). Critical: In CISA’s KEV catalogue since 24 Sept 2026: it is known to be exploited. CVSS score 10.0: 9.0 or more. CVSS score 10.0 (7.0 or more) and EPSS 0.22 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:28 GMTCVEcriticalKEVCVE-2026-1728: Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeoverhttps://agentprime.io/advisories/CVE-2026-1728/https://agentprime.io/advisories/CVE-2026-1728/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:25 GMTCVEcriticalCVE-2025-15039: Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Productshttps://agentprime.io/advisories/CVE-2025-15039/https://agentprime.io/advisories/CVE-2025-15039/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:23 GMTCVEcriticalCVE-2026-0637: Header Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log Forgeryhttps://agentprime.io/advisories/CVE-2026-0637/https://agentprime.io/advisories/CVE-2026-0637/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:20 GMTCVECVE-2025-13394: Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actionshttps://agentprime.io/advisories/CVE-2025-13394/https://agentprime.io/advisories/CVE-2025-13394/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:17 GMTCVECVE-2025-13736: Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discoveryhttps://agentprime.io/advisories/CVE-2025-13736/https://agentprime.io/advisories/CVE-2025-13736/CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:03 GMTCVECVE-2024-10302: Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposurehttps://agentprime.io/advisories/CVE-2024-10302/https://agentprime.io/advisories/CVE-2024-10302/CVSS 4.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:01 GMTCVECVE-2024-6832: Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attackshttps://agentprime.io/advisories/CVE-2024-6832/https://agentprime.io/advisories/CVE-2024-6832/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:32:59 GMTCVECVE-2024-8995: Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Accesshttps://agentprime.io/advisories/CVE-2024-8995/https://agentprime.io/advisories/CVE-2024-8995/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:32:56 GMTCVECVE-2026-2445: Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modificationhttps://agentprime.io/advisories/CVE-2026-2445/https://agentprime.io/advisories/CVE-2026-2445/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Jul 2026 08:06:39 GMTCVECVE-2026-4249: Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruptionhttps://agentprime.io/advisories/CVE-2026-4249/https://agentprime.io/advisories/CVE-2026-4249/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 10:16:56 GMTCVECVE-2025-8591: Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modificationhttps://agentprime.io/advisories/CVE-2025-8591/https://agentprime.io/advisories/CVE-2025-8591/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 10:16:53 GMTCVECVE-2024-1248: Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalationhttps://agentprime.io/advisories/CVE-2024-1248/https://agentprime.io/advisories/CVE-2024-1248/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 04 Jul 2026 20:38:49 GMTCVECVE-2025-13475: Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposurehttps://agentprime.io/advisories/CVE-2025-13475/https://agentprime.io/advisories/CVE-2025-13475/CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.Sat, 04 Jul 2026 12:49:06 GMTCVE