Advisories · Technology

WSO2 Carbon SCIM Common Component.

Every CVE that names WSO2 Carbon SCIM Common Component among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-10149 CVE record

CVSS 8.2 High

Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover
- WSO2 Identity Server as Key Manager
- WSO2 Open Banking IAM
- Information disclosure
- CWE-281
Not analysed yet 19 Oct 2026