WSO2 API Manager authorization issue vulnerability

WSO2 API Manager versions prior to 3.2.0.4.34, 3.2.1.54, 4.1.0.218, 4.2.0.156, 4.3.0.67, 4.4.0.30, and 4.5.0.14; WSO2 Universal Gateway versions prior to 4.5.0.14; WSO2 API Control Plane versions prior to 4.5.0.15; and Forgerock Key Manager Component versions prior to 1.0.0.4, 1.1.0.2, and 1.1.5....

WSO2 API Control Plane session mechanism vulnerability

WSO2 API Control Plane versions prior to 4.5.0 and 4.6.0 and 4.6.0 and 4.6.0.13 contained a session mechanism vulnerability. This vulnerability stemmed from the use of the session binding token feature and token binding verification, but without enabling the “Revoke tokens upon user logout” optio...

WSO2 API Manager Cross-Site Scripting Vulnerability

WSO2 API Manager versions prior to 3.2.0.4, 3.2.1.3 to 3.2.1.53, 4.1.0.214 to 4.1.0.215, 4.2.0.153 to 4.2.0.153, 4.3.0.66 to 4.3.0.66, 4.4.0.29 to 4.4.0.29, and 4.5.0.11 to 4.5.0.11; WSO2 Universal Gateway versions prior to 4.5.0.11; WSO2 Traffic Manager versions prior to 4.5.0.11; WSO2 API Contr...

WSO2 Universal Gateway encryption vulnerabilities

WSO2 Universal Gateway versions from 4.5.0 through 4.5.0.46 and from 4.6.0 through 4.6.0.14, WSO2 Traffic Manager versions from 4.5.0 through 4.5.0.45 and from 4.6.0 through 4.6.0.14, WSO2 API Control Plane versions from 4.5.0 through 4.5.0.47 and from 4.6.0 through 4.6.0.15, WSO2 API Manager...

PT-2026-98420

CISA added two critical flaws to the KEV catalog yesterday, confirming active exploitation in the wild. Both are being actively targeted. Technical Breakdown: - CVE-2026-5430 CVSS 9.8: Path traversal in WSO2 API Control Plane. Allows unauthenticated remote attackers to read arbitrary files or...

WSO2 Multiple Products Path Traversal Vulnerability

WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution...

WSO2’s various products have security vulnerabilities

WSO2 API Manager, among others, are products of the American company WSO2. The WSO2 API Manager is a suite of API lifecycle management solutions. The WSO2 API Control Plane is a control panel. The WSO2 Traffic Manager is a component designed to regulate and manage API traffic. Several WSO2 produc...

WSO2’s various products have security vulnerabilities

WSO2 Open Banking AM and others are products of WSO2, Inc. of the U.S.A. WSO2 Open Banking AM is an Open Banking Accelerator.WSO2 Open Banking IAM is an identity and access management solution for the Open Banking OB space.WSO2 Traffic WSO2 Traffic Manager is a component for regulating and managi...

WSO2’s various products have security vulnerabilities

WSO2 API Manager and other products are products of WSO2 Corporation, USA.WSO2 API Manager is a set of API lifecycle management solutions.WSO2 Identity Server IS is an identity server.WSO2 Enterprise Integrator is a set of open source hybrid integration platform. A security vulnerability exists i...

WSO2’s various products have security vulnerabilities

WSO2 API Manager is an API lifecycle management solution, WSO2 Identity Server IS is an identity server, and WSO2 API Control Plane is a control panel. A security vulnerability exists in several WSO2 products that stems from a lack of output encoding on the authentication endpoint, which could le...

WSO2’s various products have security vulnerabilities

WSO2 API Manager and others are products of WSO2, Inc. of the U.S. WSO2 API Manager is a suite of API lifecycle management solutions.WSO2 Identity Server IS is an identity server.WSO2 API Control Plane is a control panel. A security vulnerability exists in several WSO2 products that stems from an...

WSO2’s various products have security vulnerabilities

WSO2 API Manager is an API lifecycle management solution, WSO2 API Manager Analytics is an analytics component, and WSO2 API Control Plane is a control panel. A security vulnerability exists in a number of WSO2 products. The vulnerability stems from insufficient enforcement of permissions in the...