org.geoserver:community (1.4.0_gt2.2.x), org.geoserver:platform (>=1.4.0-m1, <=1.4.0_gt2.2.x) +6 more potentially affected by CVE-2026-22745 via org.springframework:spring-webmvc (1.2.5)

org.springframework:spring-webmvc MAVEN version 1.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.geoserver:community 1.4.0gt2.2.x - org.geoserver:platform =1.4.0-m1, =1.4.0gt2.2.x -...

org.geoserver:community (1.4.0_gt2.2.x), org.geoserver:platform (>=1.4.0-m1, <=1.4.0_gt2.2.x) +6 more potentially affected by CVE-2026-22741 via org.springframework:spring-webmvc (1.2.5)

org.springframework:spring-webmvc MAVEN version 1.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.geoserver:community 1.4.0gt2.2.x - org.geoserver:platform =1.4.0-m1, =1.4.0gt2.2.x -...

GHSA-P93R-85WP-75V3 vulnerabilities

Vulnerabilities for packages: jenkins, zipkin, ruby3.2-bouncy-castle-java, geoserver, apache-nifi, pinot-fips, ruby3.4-bouncy-castle-java, sonarqube, elasticsearch, logstash-fips, ruby4.0-bouncy-castle-java, keycloak, opensearch, gradle, pinot, jruby, druid, thingsboard, spark,...

CVE-2026-5598 vulnerabilities

Vulnerabilities for packages: jenkins, zipkin, ruby3.2-bouncy-castle-java, geoserver, apache-nifi, pinot-fips, ruby3.4-bouncy-castle-java, sonarqube, elasticsearch, logstash-fips, ruby4.0-bouncy-castle-java, keycloak, opensearch, gradle, pinot, jruby, druid, thingsboard, spark,...

CVE-2026-33227 vulnerabilities

Vulnerabilities for packages: zipkin, apache-activemq-artemis, geoserver...

GHSA-H2H4-5M64-M273 vulnerabilities

Vulnerabilities for packages: zipkin, apache-activemq-artemis, geoserver...

CVE-2026-39304 vulnerabilities

Vulnerabilities for packages: zipkin, apache-activemq-artemis, geoserver...

GHSA-5568-6QCG-G7FX vulnerabilities

Vulnerabilities for packages: zipkin, apache-activemq-artemis, geoserver...

CVE-2026-34197 vulnerabilities

Vulnerabilities for packages: apache-activemq, geoserver, apache-activemq-fips...

GHSA-RXPJ-7QVF-XV32 vulnerabilities

Vulnerabilities for packages: apache-activemq, geoserver, apache-activemq-fips...

CVE-2020-11971 vulnerabilities

Vulnerabilities for packages: geoserver...

CVE-2025-66168 vulnerabilities

Vulnerabilities for packages: geoserver...

GHSA-C825-6PH3-4H84 vulnerabilities

Vulnerabilities for packages: geoserver...

GHSA-HFG5-XPVW-C9X4 vulnerabilities

Vulnerabilities for packages: geoserver...

com.spatineo:geoserver-tomcat8-valve (1.0), org.apache.tomcat:tomcat-catalina (8.5.46) +11 more potentially affected by CVE-2026-24733 via org.apache.tomcat:tomcat-coyote (8.5.46)

org.apache.tomcat:tomcat-coyote MAVEN version 8.5.46 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-coyote and may be impacted: - com.spatineo:geoserver-tomcat8-valve 1.0 - org.apache.tomcat:tomcat-catalina 8.5.46 -...

CVE-2023-43795

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The OGC Web Processing Service WPS specification is designed to process information from any server using GET and POST requests. This presents the opportunity for Server Side Request...

Exploit for Improper Restriction of XML External Entity Reference in Geoserver

During my geoserver analysis I found another way to attack una...

XML External Entity (XXE)

GeoServer is vulnerable to XML External Entity XXE. The vulnerability is due to improper handling of XML entity resolution in schema parsing, which allows an attacker to exploit external entity references to access sensitive data or perform unauthorized actions...

Exploit for Improper Restriction of XML External Entity Reference in Geoserver

CVE-2025-58360: GeoServer XXE Lab Unauthenticated XML Ext...

Vulnerability fixed in GeoServer

OSGeo has fixed a vulnerability in GeoServer. The vulnerability is in the way GeoServer processes XML input, specifically via the /geoserver/wms GetMap operation. Improper sanitation of XML input allows attackers to disclose sensitive files or conduct denial-of-service attacks using custom XML...