Overview 6 matches · 2 in Waratek scope · 0 protected · 2 CISA KEV · 5 public PoC · 1 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
2
33.3%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
4
66.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
5
83.3%
not established
1
16.7%
unrecorded
0
0.0%
Exploited
6
100.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 2 / year
20201
Not applicable1
Critical1
not blocked1
Exploited1
20211
Not applicable1
Medium1
not blocked1
Exploited1
20221
Not applicable1
Critical1
not blocked1
Exploited1
20230
20240
20252
Mitigation candidate1
Not applicable1
Medium2
not blocked2
Exploited2
20261
Mitigation candidate1
Critical1
not established1
Exploited1
2020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-5430 | Critical | 2026-08-06 | Mitigation candidate | Exploited | The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary. |
| CVE-2025-5605 | Medium | 2025-10-24 | Mitigation candidate | Exploited | An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure. The known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details. |
| CVE-2024-7097 | Medium | 2025-05-30 | Not applicable | Exploited | An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration settings. This vulnerability enables malicious actors to create new user accounts without proper authorization. Exploitation of this flaw could allow an attacker to create multiple low-privileged user accounts, gaining unauthorized access to the system. Additionally, continuous exploitation could lead to system resource exhaustion through mass user creation. |
| CVE-2022-29464 | Critical | 2022-04-18 | Not applicable | Exploited | Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0. |
| CVE-2020-17453 | Medium | 2021-04-05 | Not applicable | Exploited | WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter. |
| CVE-2020-24589 | Critical | 2020-08-21 | Not applicable | Exploited | The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks. |