agentprime: wso2-identity-server-as-key-managerEvery new CVE for wso2-identity-server-as-key-manager.https://agentprime.io/CVE-2025-1397: Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providershttps://agentprime.io/advisories/CVE-2025-1397/https://agentprime.io/advisories/CVE-2025-1397/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 06:07:57 GMTCVECVE-2024-12139: Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attackshttps://agentprime.io/advisories/CVE-2024-12139/https://agentprime.io/advisories/CVE-2024-12139/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 17:34:20 GMTCVECVE-2024-9517: Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accountshttps://agentprime.io/advisories/CVE-2024-9517/https://agentprime.io/advisories/CVE-2024-9517/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 11:30:15 GMTCVECVE-2024-2372: Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attackshttps://agentprime.io/advisories/CVE-2024-2372/https://agentprime.io/advisories/CVE-2024-2372/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 11:00:23 GMTCVECVE-2026-18800: Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Datahttps://agentprime.io/advisories/CVE-2026-18800/https://agentprime.io/advisories/CVE-2026-18800/CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 09:59:26 GMTCVECVE-2025-13647: Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Pathshttps://agentprime.io/advisories/CVE-2025-13647/https://agentprime.io/advisories/CVE-2025-13647/CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 09:20:52 GMTCVECVE-2025-11969: Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actionshttps://agentprime.io/advisories/CVE-2025-11969/https://agentprime.io/advisories/CVE-2025-11969/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 05:53:51 GMTCVEcriticalCVE-2026-3583: Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]https://agentprime.io/advisories/CVE-2026-3583/https://agentprime.io/advisories/CVE-2026-3583/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 19:21:34 GMTCVECVE-2025-14260: Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resourceshttps://agentprime.io/advisories/CVE-2025-14260/https://agentprime.io/advisories/CVE-2025-14260/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 19:21:32 GMTCVECVE-2024-6423: Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakagehttps://agentprime.io/advisories/CVE-2024-6423/https://agentprime.io/advisories/CVE-2024-6423/CVSS 4.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 13:56:26 GMTCVECVE-2024-7478: Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discoveryhttps://agentprime.io/advisories/CVE-2024-7478/https://agentprime.io/advisories/CVE-2024-7478/CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 13:49:07 GMTCVECVE-2024-5139: Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirectionhttps://agentprime.io/advisories/CVE-2024-5139/https://agentprime.io/advisories/CVE-2024-5139/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 13:36:49 GMTCVECVE-2024-2323: Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discoveryhttps://agentprime.io/advisories/CVE-2024-2323/https://agentprime.io/advisories/CVE-2024-2323/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 07:46:37 GMTCVECVE-2024-4412: Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operationshttps://agentprime.io/advisories/CVE-2024-4412/https://agentprime.io/advisories/CVE-2024-4412/CVSS 2.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 16:59:05 GMTCVECVE-2025-13173: Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Terminationhttps://agentprime.io/advisories/CVE-2025-13173/https://agentprime.io/advisories/CVE-2025-13173/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 16:49:08 GMTCVECVE-2025-10149: Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeoverhttps://agentprime.io/advisories/CVE-2025-10149/https://agentprime.io/advisories/CVE-2025-10149/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 16:40:26 GMTCVECVE-2024-4457: Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Executionhttps://agentprime.io/advisories/CVE-2024-4457/https://agentprime.io/advisories/CVE-2024-4457/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sun, 18 Oct 2026 18:05:34 GMTCVEcriticalCVE-2025-5802: Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discoveryhttps://agentprime.io/advisories/CVE-2025-5802/https://agentprime.io/advisories/CVE-2025-5802/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 09:53:53 GMTCVECVE-2025-12737: Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Executionhttps://agentprime.io/advisories/CVE-2025-12737/https://agentprime.io/advisories/CVE-2025-12737/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 03 Sep 2026 13:02:26 GMTCVECVE-2025-15039: Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Productshttps://agentprime.io/advisories/CVE-2025-15039/https://agentprime.io/advisories/CVE-2025-15039/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:23 GMTCVEcriticalCVE-2025-13394: Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actionshttps://agentprime.io/advisories/CVE-2025-13394/https://agentprime.io/advisories/CVE-2025-13394/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:17 GMTCVECVE-2025-13736: Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discoveryhttps://agentprime.io/advisories/CVE-2025-13736/https://agentprime.io/advisories/CVE-2025-13736/CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:03 GMTCVECVE-2024-10302: Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposurehttps://agentprime.io/advisories/CVE-2024-10302/https://agentprime.io/advisories/CVE-2024-10302/CVSS 4.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:01 GMTCVECVE-2024-6832: Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attackshttps://agentprime.io/advisories/CVE-2024-6832/https://agentprime.io/advisories/CVE-2024-6832/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:32:59 GMTCVECVE-2024-8995: Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Accesshttps://agentprime.io/advisories/CVE-2024-8995/https://agentprime.io/advisories/CVE-2024-8995/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:32:56 GMTCVECVE-2025-8591: Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modificationhttps://agentprime.io/advisories/CVE-2025-8591/https://agentprime.io/advisories/CVE-2025-8591/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 10:16:53 GMTCVECVE-2024-1248: Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalationhttps://agentprime.io/advisories/CVE-2024-1248/https://agentprime.io/advisories/CVE-2024-1248/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 04 Jul 2026 20:38:49 GMTCVECVE-2024-0391: Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discoveryhttps://agentprime.io/advisories/CVE-2024-0391/https://agentprime.io/advisories/CVE-2024-0391/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 11 May 2026 08:45:33 GMTCVECVE-2024-2374: XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Servicehttps://agentprime.io/advisories/CVE-2024-2374/https://agentprime.io/advisories/CVE-2024-2374/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 16 Apr 2026 08:12:58 GMTCVECVE-2025-9312: Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Productshttps://agentprime.io/advisories/CVE-2025-9312/https://agentprime.io/advisories/CVE-2025-9312/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Nov 2025 12:05:22 GMTCVEcriticalCVE-2025-6670: Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Serviceshttps://agentprime.io/advisories/CVE-2025-6670/https://agentprime.io/advisories/CVE-2025-6670/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Nov 2025 11:28:37 GMTCVECVE-2025-10853: Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encodinghttps://agentprime.io/advisories/CVE-2025-10853/https://agentprime.io/advisories/CVE-2025-10853/CVSS 5.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 05 Nov 2025 19:21:32 GMTCVECVE-2025-11093: Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)https://agentprime.io/advisories/CVE-2025-11093/https://agentprime.io/advisories/CVE-2025-11093/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 05 Nov 2025 18:31:17 GMTCVECVE-2025-10907: Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Executionhttps://agentprime.io/advisories/CVE-2025-10907/https://agentprime.io/advisories/CVE-2025-10907/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 05 Nov 2025 18:03:49 GMTCVECVE-2025-3125: Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Executionhttps://agentprime.io/advisories/CVE-2025-3125/https://agentprime.io/advisories/CVE-2025-3125/CVSS 6.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 05 Nov 2025 14:49:44 GMTCVECVE-2025-5605: Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosurehttps://agentprime.io/advisories/CVE-2025-5605/https://agentprime.io/advisories/CVE-2025-5605/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 24 Oct 2025 10:09:59 GMTCVECVE-2025-5350: SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Productshttps://agentprime.io/advisories/CVE-2025-5350/https://agentprime.io/advisories/CVE-2025-5350/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 24 Oct 2025 10:08:07 GMTCVECVE-2025-9804: Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIshttps://agentprime.io/advisories/CVE-2025-9804/https://agentprime.io/advisories/CVE-2025-9804/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 16 Oct 2025 12:33:45 GMTCVEcriticalCVE-2025-10611: Potential Broken Access Control in Multiple WSO2 Products via System REST APIshttps://agentprime.io/advisories/CVE-2025-10611/https://agentprime.io/advisories/CVE-2025-10611/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 16 Oct 2025 12:09:31 GMTCVEcriticalCVE-2025-1862: Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Executionhttps://agentprime.io/advisories/CVE-2025-1862/https://agentprime.io/advisories/CVE-2025-1862/CVSS 6.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Sep 2025 08:18:21 GMTCVECVE-2025-0672: Authentication Bypass in Multiple WSO2 Products via Stale FIDO Credential Associationhttps://agentprime.io/advisories/CVE-2025-0672/https://agentprime.io/advisories/CVE-2025-0672/CVSS 3.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 23 Sep 2025 17:30:42 GMTCVECVE-2025-0663: Potential cross-tenant account takeover vulnerability in Multiple WSO2 Products via Adaptive Authentication and Auto-Loginhttps://agentprime.io/advisories/CVE-2025-0663/https://agentprime.io/advisories/CVE-2025-0663/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 23 Sep 2025 16:58:06 GMTCVECVE-2024-3511: Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Fileshttps://agentprime.io/advisories/CVE-2024-3511/https://agentprime.io/advisories/CVE-2024-3511/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 23 Jun 2025 08:47:55 GMTCVECVE-2024-3509: Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editorhttps://agentprime.io/advisories/CVE-2024-3509/https://agentprime.io/advisories/CVE-2024-3509/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Jun 2025 16:44:28 GMTCVECVE-2024-7073: Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Serviceshttps://agentprime.io/advisories/CVE-2024-7073/https://agentprime.io/advisories/CVE-2024-7073/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Jun 2025 16:38:33 GMTCVECVE-2024-7097: Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signuphttps://agentprime.io/advisories/CVE-2024-7097/https://agentprime.io/advisories/CVE-2024-7097/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 May 2025 15:04:09 GMTCVECVE-2024-6914: Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeoverhttps://agentprime.io/advisories/CVE-2024-6914/https://agentprime.io/advisories/CVE-2024-6914/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 22 May 2025 18:26:15 GMTCVEcritical