WSO2 WSO2 Carbon API Management Implementation
5 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-3418 | 9.30.67 – < 9.30.67.156 ; 9.31.86 – < 9.31.86.141 ; 9.32.147 – < 9.32.147.44 | Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution | CRITICAL 9.1 | 0.8 % | ||
| CVE-2026-3415 | | XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service | HIGH 8.7 | 0.5 % | ||
| CVE-2025-14561 | 9.20.74 – < 9.20.74.388 ; 9.28.116 – < 9.28.116.395 ; 9.29.120 – < 9.29.120.213 ; … | Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations | CRITICAL 9.0 | 0.4 % | ||
| CVE-2025-8325 | 6.7.206 – < 6.7.206.563 ; 6.7.210 – < 6.7.210.55 ; 9.0.174 – < 9.0.174.513 ; … | Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations | HIGH 8.8 | 0.2 % | ||
| CVE-2025-8154 | | HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation | HIGH 7.5 | 0.2 % |