agentprime: wso2-traffic-managerEvery new CVE for wso2-traffic-manager.https://agentprime.io/CVE-2025-1397: Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providershttps://agentprime.io/advisories/CVE-2025-1397/https://agentprime.io/advisories/CVE-2025-1397/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 06:07:57 GMTCVECVE-2024-9517: Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accountshttps://agentprime.io/advisories/CVE-2024-9517/https://agentprime.io/advisories/CVE-2024-9517/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 11:30:15 GMTCVECVE-2026-2613: SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruptionhttps://agentprime.io/advisories/CVE-2026-2613/https://agentprime.io/advisories/CVE-2026-2613/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 10:11:53 GMTCVECVE-2026-18800: Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Datahttps://agentprime.io/advisories/CVE-2026-18800/https://agentprime.io/advisories/CVE-2026-18800/CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 09:59:26 GMTCVECVE-2025-11969: Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actionshttps://agentprime.io/advisories/CVE-2025-11969/https://agentprime.io/advisories/CVE-2025-11969/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 05:53:51 GMTCVEcriticalCVE-2026-3583: Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]https://agentprime.io/advisories/CVE-2026-3583/https://agentprime.io/advisories/CVE-2026-3583/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 19:21:34 GMTCVECVE-2025-13173: Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Terminationhttps://agentprime.io/advisories/CVE-2025-13173/https://agentprime.io/advisories/CVE-2025-13173/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 16:49:08 GMTCVECVE-2025-7203: Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentialshttps://agentprime.io/advisories/CVE-2025-7203/https://agentprime.io/advisories/CVE-2025-7203/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 16:38:01 GMTCVECVE-2025-6623: Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirectionhttps://agentprime.io/advisories/CVE-2025-6623/https://agentprime.io/advisories/CVE-2025-6623/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 16:25:50 GMTCVECVE-2025-5802: Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discoveryhttps://agentprime.io/advisories/CVE-2025-5802/https://agentprime.io/advisories/CVE-2025-5802/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 15 Sep 2026 09:53:53 GMTCVECVE-2025-12737: Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Executionhttps://agentprime.io/advisories/CVE-2025-12737/https://agentprime.io/advisories/CVE-2025-12737/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 03 Sep 2026 13:02:26 GMTCVECVE-2026-3418: Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Executionhttps://agentprime.io/advisories/CVE-2026-3418/https://agentprime.io/advisories/CVE-2026-3418/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 17:32:14 GMTCVEcriticalCVE-2026-3415: XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Servicehttps://agentprime.io/advisories/CVE-2026-3415/https://agentprime.io/advisories/CVE-2026-3415/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 17:32:10 GMTCVECVE-2025-14561: Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operationshttps://agentprime.io/advisories/CVE-2025-14561/https://agentprime.io/advisories/CVE-2025-14561/CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 17:32:07 GMTCVEcriticalCVE-2026-5430: Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeoverhttps://agentprime.io/advisories/CVE-2026-5430/https://agentprime.io/advisories/CVE-2026-5430/CVSS 10.0 (Critical). Critical: In CISA’s KEV catalogue since 24 Sept 2026: it is known to be exploited. CVSS score 10.0: 9.0 or more. CVSS score 10.0 (7.0 or more) and EPSS 0.22 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:28 GMTCVEcriticalKEVCVE-2026-1728: Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeoverhttps://agentprime.io/advisories/CVE-2026-1728/https://agentprime.io/advisories/CVE-2026-1728/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:25 GMTCVEcriticalCVE-2025-15039: Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Productshttps://agentprime.io/advisories/CVE-2025-15039/https://agentprime.io/advisories/CVE-2025-15039/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:23 GMTCVEcriticalCVE-2025-13394: Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actionshttps://agentprime.io/advisories/CVE-2025-13394/https://agentprime.io/advisories/CVE-2025-13394/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:17 GMTCVECVE-2024-10302: Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposurehttps://agentprime.io/advisories/CVE-2024-10302/https://agentprime.io/advisories/CVE-2024-10302/CVSS 4.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:33:01 GMTCVECVE-2024-6832: Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attackshttps://agentprime.io/advisories/CVE-2024-6832/https://agentprime.io/advisories/CVE-2024-6832/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:32:59 GMTCVECVE-2024-8995: Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Accesshttps://agentprime.io/advisories/CVE-2024-8995/https://agentprime.io/advisories/CVE-2024-8995/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 07:32:56 GMTCVECVE-2026-4249: Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruptionhttps://agentprime.io/advisories/CVE-2026-4249/https://agentprime.io/advisories/CVE-2026-4249/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 10:16:56 GMTCVECVE-2025-8591: Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modificationhttps://agentprime.io/advisories/CVE-2025-8591/https://agentprime.io/advisories/CVE-2025-8591/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 06 Jul 2026 10:16:53 GMTCVECVE-2025-8325: Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operationshttps://agentprime.io/advisories/CVE-2025-8325/https://agentprime.io/advisories/CVE-2025-8325/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 11 May 2026 09:37:16 GMTCVECVE-2025-8154: HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulationhttps://agentprime.io/advisories/CVE-2025-8154/https://agentprime.io/advisories/CVE-2025-8154/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 11 May 2026 09:30:36 GMTCVECVE-2025-9312: Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Productshttps://agentprime.io/advisories/CVE-2025-9312/https://agentprime.io/advisories/CVE-2025-9312/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Nov 2025 12:05:22 GMTCVEcriticalCVE-2025-6670: Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Serviceshttps://agentprime.io/advisories/CVE-2025-6670/https://agentprime.io/advisories/CVE-2025-6670/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Nov 2025 11:28:37 GMTCVECVE-2025-10853: Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encodinghttps://agentprime.io/advisories/CVE-2025-10853/https://agentprime.io/advisories/CVE-2025-10853/CVSS 5.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 05 Nov 2025 19:21:32 GMTCVECVE-2025-11093: Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)https://agentprime.io/advisories/CVE-2025-11093/https://agentprime.io/advisories/CVE-2025-11093/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 05 Nov 2025 18:31:17 GMTCVECVE-2025-10907: Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Executionhttps://agentprime.io/advisories/CVE-2025-10907/https://agentprime.io/advisories/CVE-2025-10907/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 05 Nov 2025 18:03:49 GMTCVECVE-2025-3125: Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Executionhttps://agentprime.io/advisories/CVE-2025-3125/https://agentprime.io/advisories/CVE-2025-3125/CVSS 6.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 05 Nov 2025 14:49:44 GMTCVECVE-2025-5605: Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosurehttps://agentprime.io/advisories/CVE-2025-5605/https://agentprime.io/advisories/CVE-2025-5605/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 24 Oct 2025 10:09:59 GMTCVECVE-2025-5350: SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Productshttps://agentprime.io/advisories/CVE-2025-5350/https://agentprime.io/advisories/CVE-2025-5350/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 24 Oct 2025 10:08:07 GMTCVECVE-2025-9804: Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIshttps://agentprime.io/advisories/CVE-2025-9804/https://agentprime.io/advisories/CVE-2025-9804/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 16 Oct 2025 12:33:45 GMTCVEcriticalCVE-2025-10611: Potential Broken Access Control in Multiple WSO2 Products via System REST APIshttps://agentprime.io/advisories/CVE-2025-10611/https://agentprime.io/advisories/CVE-2025-10611/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 16 Oct 2025 12:09:31 GMTCVEcriticalCVE-2025-5717: Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Servicehttps://agentprime.io/advisories/CVE-2025-5717/https://agentprime.io/advisories/CVE-2025-5717/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 23 Sep 2025 16:05:19 GMTCVE