vendor1 exploited in the wild

Wso2

7 CVEs published in the last four months. Exploited flaws first.

Critical3

High4

Medium0

Exploited (KEV)1

Patch these first

CVE	CVSS	Severity	Product	Summary	Published
CVE-2026-5430exploited	10	critical	api control plane	The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or su	77d ago

All recent CVEs

CVE	CVSS	Severity	Product	Summary	Published
CVE-2026-5430exploited	10	critical	api control plane	The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or su	77d ago
CVE-2026-1728	9.8	critical	api control plane	Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-	77d ago
CVE-2025-15039	9.4	critical	api control plane	The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all r	77d ago
CVE-2026-4249	8.6	high	api control plane	The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without suffi	108d ago
CVE-2025-10470	8.6	high	identity server	The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting	164d ago
CVE-2026-2053	8.3	high	api manager	The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validat	118d ago
CVE-2025-10908	7.3	high	identity server	Due to a lack of user account state validation during authentication, locked user accounts can be successfully aut	164d ago

Filter the full tracker by Wso2 →