CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

81 matches found

Positive Technologies•added 2026/06/12 12:0 a.m.•14 views

PT-2026-49053

Name of the Vulnerable Software and Affected Versions GeoServer versions prior to 2.26.4 GeoServer versions prior to 2.27.3 Description An authenticated administrator with access to the security system can provide arbitrary absolute file paths to the Master Password Dump web page to create files...

7.2CVSS8.2AI score0.00353EPSS

Exploits0References9

Github Security Blog•added 2026/06/11 8:34 p.m.•10 views

GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

Summary Administrator can perform JNDI attack through specially crafted DB2 jdbc url leading to Remote Code Execution RCE. Impact If GeoServer has DB2 extension installed, this vulnerability can lead to executing arbitrary code. Details Authenticated users can access Vector Data Sources page to...

8.8CVSS7.2AI score0.01378EPSS

Exploits0References3Affected Software1

Veracode•added 2025/12/13 4:53 a.m.•5 views

XML External Entity (XXE)

GeoServer is vulnerable to XML External Entity XXE. The vulnerability is due to improper handling of XML entity resolution in schema parsing, which allows an attacker to exploit external entity references to access sensitive data or perform unauthorized actions...

9.9CVSS5.3AI score0.50825EPSS

Exploits1References9Affected Software2

The Hacker News•added 2025/12/12 5:1 a.m.•19 views

CISA Flags Actively Exploited GeoServer XXE Flaw in Updated KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday added a high-severity security flaw impacting OSGeo GeoServer to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation in the wild. The vulnerability in question is CVE-2025-58360 CVSS...

9.8CVSS7.1AI score0.99813EPSS

Exploits29

NVD•added 2025/11/25 9:15 p.m.•6 views

CVE-2025-58360

GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity XXE vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap...

9.8CVSS0.66753EPSS

Exploits4References3