CVE-2025-58360-GeoServer-XXE

CVE-2025-58360: Laboratorio XXE de GeoServer Inyección no autenticada de entidad externa XML XXE en los servicios OWS/WMS de GeoServer CVSS: 9.8 CRITICAL Afectadas: SLDHandler.parse | | - SLDParser.parseSLD | -- NO EntityResolver! +--...

CVE-2026-50126

adaguc-server (versions prior to 7.2.2) has a memory-safety flaw in adagucserverEC/CConvertGeoJSON.cpp: it indexes coordinate array values and uses array length as a loop bound without validating JSON node type or coordinate length, affecting Polygon, LineString, MultiLineString and MultiPolygon ...

CVE-2026-39922 GeoNode SSRF via Service Registration

GeoNode versions 4.4.5 and 5.0.2 and prior within their respective releases contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network requests to arbitrary URLs by submitting a crafted service URL durin...

CVE-2026-39922: Server-Side Request Forgery (SSRF)

GeoNode versions 4.4.5 and 5.0.2 and prior within their respective releases contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network requests to arbitrary URLs by submitting a crafted service URL durin...