Advisories · Technology

WSO2 Carbon SCIM 2.0 Common Component.

Every CVE that names WSO2 Carbon SCIM 2.0 Common Component among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-10149 CVE record

CVSS 8.2 High

Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover
- WSO2 Identity Server as Key Manager
- WSO2 Open Banking IAM
- Information disclosure
- CWE-281
Not analysed yet 19 Oct 2026