Vulnerability-Lookup

CVE-2026-2445 (GCVE-0-2026-2445)

Vulnerability from cvelistv5 – Published: 2026-07-20 08:06 – Updated: 2026-07-20 13:52

Title

Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification

Summary

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the user's browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

WSO2

References

1 reference

URL	Tags
https://security.docs.wso2.com/en/latest/security…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
WSO2	WSO2 API Manager	Affected: 4.2.0 , < 4.2.0.195 (custom) Affected: 4.3.0 , < 4.3.0.106 (custom) Affected: 4.4.0 , < 4.4.0.70 (custom) Affected: 4.5.0 , < 4.5.0.55 (custom) Affected: 4.6.0 , < 4.6.0.19 (custom)
WSO2	WSO2 API Control Plane	Affected: 4.5.0 , < 4.5.0.56 (custom) Affected: 4.6.0 , < 4.6.0.20 (custom)
WSO2	WSO2 Identity Server	Affected: 6.0.0 , < 6.0.0.263 (custom) Affected: 6.1.0 , < 6.1.0.266 (custom) Affected: 7.0.0 , < 7.0.0.144 (custom) Affected: 7.1.0 , < 7.1.0.53 (custom) Affected: 7.2.0 , < 7.2.0.12 (custom)

Credits

Maneesha Dewmine

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-2445",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-20T13:52:47.520347Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-20T13:52:59.977Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.2.0.195",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.0.106",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.0.70",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.55",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.19",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Control Plane",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.56",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.20",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.0.0.263",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.0.266",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.0.144",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.1.0.53",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.2.0.12",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.2.0.195",
                  "versionStartIncluding": "4.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.3.0.106",
                  "versionStartIncluding": "4.3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.0.70",
                  "versionStartIncluding": "4.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.5.0.55",
                  "versionStartIncluding": "4.5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.6.0.19",
                  "versionStartIncluding": "4.6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.5.0.56",
                  "versionStartIncluding": "4.5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.6.0.20",
                  "versionStartIncluding": "4.6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.0.263",
                  "versionStartIncluding": "6.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.0.266",
                  "versionStartIncluding": "6.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.0.144",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.0.53",
                  "versionStartIncluding": "7.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.0.12",
                  "versionStartIncluding": "7.2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Maneesha Dewmine"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads.\n\nAn attacker can leverage this vulnerability to cause the user\u0027s browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag."
            }
          ],
          "value": "The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads.\n\nAn attacker can leverage this vulnerability to cause the user\u0027s browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-22",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-22 CAPEC-22: Cross-Site Scripting"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-20T08:06:39.095Z",
        "orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "shortName": "WSO2"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5059/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5059/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5059/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
            }
          ],
          "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5059/#solution"
        }
      ],
      "source": {
        "advisory": "WSO2-2026-5059",
        "discovery": "EXTERNAL"
      },
      "title": "Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
    "assignerShortName": "WSO2",
    "cveId": "CVE-2026-2445",
    "datePublished": "2026-07-20T08:06:39.095Z",
    "dateReserved": "2026-02-13T07:48:55.362Z",
    "dateUpdated": "2026-07-20T13:52:59.977Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-2445",
      "date": "2026-07-21",
      "epss": "0.00149",
      "percentile": "0.04533"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-2445\",\"sourceIdentifier\":\"ed10eef1-636d-4fbe-9993-6890dfa878f8\",\"published\":\"2026-07-20T08:16:30.143\",\"lastModified\":\"2026-07-20T15:16:36.853\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads.\\n\\nAn attacker can leverage this vulnerability to cause the user\u0027s browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag.\"}],\"affected\":[{\"source\":\"ed10eef1-636d-4fbe-9993-6890dfa878f8\",\"affectedData\":[{\"vendor\":\"WSO2\",\"product\":\"WSO2 API Manager\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.2.0\",\"lessThan\":\"4.2.0.195\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.3.0\",\"lessThan\":\"4.3.0.106\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.4.0\",\"lessThan\":\"4.4.0.70\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.5.0\",\"lessThan\":\"4.5.0.55\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.6.0\",\"lessThan\":\"4.6.0.19\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WSO2\",\"product\":\"WSO2 API Control Plane\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.5.0\",\"lessThan\":\"4.5.0.56\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.6.0\",\"lessThan\":\"4.6.0.20\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"WSO2\",\"product\":\"WSO2 Identity Server\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"6.0.0\",\"lessThan\":\"6.0.0.263\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"6.1.0\",\"lessThan\":\"6.1.0.266\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"7.0.0\",\"lessThan\":\"7.0.0.144\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"7.1.0\",\"lessThan\":\"7.1.0.53\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"7.2.0\",\"lessThan\":\"7.2.0.12\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"ed10eef1-636d-4fbe-9993-6890dfa878f8\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-20T13:52:47.520347Z\",\"id\":\"CVE-2026-2445\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"ed10eef1-636d-4fbe-9993-6890dfa878f8\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5059/\",\"source\":\"ed10eef1-636d-4fbe-9993-6890dfa878f8\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-2445\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-20T13:52:47.520347Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-20T13:52:54.856Z\"}}], \"cna\": {\"title\": \"Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification\", \"source\": {\"advisory\": \"WSO2-2026-5059\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Maneesha Dewmine\"}], \"impacts\": [{\"capecId\": \"CAPEC-22\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-22 CAPEC-22: Cross-Site Scripting\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"WSO2\", \"product\": \"WSO2 API Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.2.0\", \"lessThan\": \"4.2.0.195\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.3.0\", \"lessThan\": \"4.3.0.106\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.4.0\", \"lessThan\": \"4.4.0.70\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.5.0\", \"lessThan\": \"4.5.0.55\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.6.0\", \"lessThan\": \"4.6.0.19\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 API Control Plane\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.5.0\", \"lessThan\": \"4.5.0.56\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.6.0\", \"lessThan\": \"4.6.0.20\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Identity Server\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.0.0\", \"lessThan\": \"6.0.0.263\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.1.0\", \"lessThan\": \"6.1.0.266\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"7.0.0\", \"lessThan\": \"7.0.0.144\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"7.1.0\", \"lessThan\": \"7.1.0.53\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"7.2.0\", \"lessThan\": \"7.2.0.12\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5059/#solution\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: transparent;\\\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5059/#solution\\\"\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5059/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5059/\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads.\\n\\nAn attacker can leverage this vulnerability to cause the user\u0027s browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads.\\n\\nAn attacker can leverage this vulnerability to cause the user\u0027s browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.2.0.195\", \"versionStartIncluding\": \"4.2.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.3.0.106\", \"versionStartIncluding\": \"4.3.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.4.0.70\", \"versionStartIncluding\": \"4.4.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.5.0.55\", \"versionStartIncluding\": \"4.5.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.6.0.19\", \"versionStartIncluding\": \"4.6.0\"}], \"operator\": \"OR\"}, {\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.5.0.56\", \"versionStartIncluding\": \"4.5.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.6.0.20\", \"versionStartIncluding\": \"4.6.0\"}], \"operator\": \"OR\"}, {\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.0.0.263\", \"versionStartIncluding\": \"6.0.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.0.266\", \"versionStartIncluding\": \"6.1.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.0.0.144\", \"versionStartIncluding\": \"7.0.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.1.0.53\", \"versionStartIncluding\": \"7.1.0\"}, {\"criteria\": \"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.2.0.12\", \"versionStartIncluding\": \"7.2.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"ed10eef1-636d-4fbe-9993-6890dfa878f8\", \"shortName\": \"WSO2\", \"dateUpdated\": \"2026-07-20T08:06:39.095Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-2445\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-20T13:52:59.977Z\", \"dateReserved\": \"2026-02-13T07:48:55.362Z\", \"assignerOrgId\": \"ed10eef1-636d-4fbe-9993-6890dfa878f8\", \"datePublished\": \"2026-07-20T08:06:39.095Z\", \"assignerShortName\": \"WSO2\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-2445

Vulnerability from fkie_nvd - Published: 2026-07-20 08:16 - Updated: 2026-07-20 15:16

Severity

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

	URL	Tags
	ed10eef1-636d-4fbe-9993-6890dfa878f8	https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5059/

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.2.0.195",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.0.106",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.0.70",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.55",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.19",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Control Plane",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.56",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.20",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.0.0.263",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.0.266",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.0.144",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.1.0.53",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.2.0.12",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads.\n\nAn attacker can leverage this vulnerability to cause the user\u0027s browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag."
    }
  ],
  "id": "CVE-2026-2445",
  "lastModified": "2026-07-20T15:16:36.853",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-2445",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-20T13:52:47.520347Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-20T08:16:30.143",
  "references": [
    {
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5059/"
    }
  ],
  "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "type": "Secondary"
    }
  ]
}

GHSA-VCJ5-R64M-JR4F

Vulnerability from github – Published: 2026-07-20 09:31 – Updated: 2026-07-20 09:31

Details

An attacker can leverage this vulnerability to cause the user's browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag.

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-2445"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-20T08:16:30Z",
    "severity": "MODERATE"
  },
  "details": "The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads.\n\nAn attacker can leverage this vulnerability to cause the user\u0027s browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag.",
  "id": "GHSA-vcj5-r64m-jr4f",
  "modified": "2026-07-20T09:31:08Z",
  "published": "2026-07-20T09:31:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2445"
    },
    {
      "type": "WEB",
      "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5059"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2026-2085

Vulnerability from csaf_certbund - Published: 2026-06-25 22:00 - Updated: 2026-07-20 22:00

Summary

WSO2 API Manager: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: WSO2 API Manager ist eine Open-Source-Plattform für das Management von APIs, die deren Erstellung, Veröffentlichung, Steuerung und Analyse ermöglicht.

Angriff: Ein Angreifer kann mehrere Schwachstellen in WSO2 API Manager ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um seine Privilegien zu erhöhen, um beliebigen Programmcode auszuführen, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, um Informationen offenzulegen, und um Daten zu manipulieren.

Betroffene Betriebssysteme: - Linux - UNIX

CVE-2025-13173

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source WSO2 API Manager Open Source	`cpe:/a:wso2:api_manager:-`	—

CVE-2025-13394

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source WSO2 API Manager Open Source	`cpe:/a:wso2:api_manager:-`	—

CVE-2025-5717

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source WSO2 API Manager Open Source	`cpe:/a:wso2:api_manager:-`	—

CVE-2026-0637

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source WSO2 API Manager Open Source	`cpe:/a:wso2:api_manager:-`	—

CVE-2026-1728

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source WSO2 API Manager Open Source	`cpe:/a:wso2:api_manager:-`	—

CVE-2026-2053

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source WSO2 API Manager Open Source	`cpe:/a:wso2:api_manager:-`	—

CVE-2026-2445

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source WSO2 API Manager Open Source	`cpe:/a:wso2:api_manager:-`	—

CVE-2026-2613

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source WSO2 API Manager Open Source	`cpe:/a:wso2:api_manager:-`	—

CVE-2026-3415

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source WSO2 API Manager Open Source	`cpe:/a:wso2:api_manager:-`	—

CVE-2026-3418

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source WSO2 API Manager Open Source	`cpe:/a:wso2:api_manager:-`	—

CVE-2026-4052

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source WSO2 API Manager Open Source	`cpe:/a:wso2:api_manager:-`	—

CVE-2026-4249

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source WSO2 API Manager Open Source	`cpe:/a:wso2:api_manager:-`	—

CVE-2026-5430

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source WSO2 API Manager Open Source	`cpe:/a:wso2:api_manager:-`	—

References

18 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://security.docs.wso2.com/en/latest/security…	external
https://security.docs.wso2.com/en/latest/security…	external
https://security.docs.wso2.com/en/latest/security…	external
https://security.docs.wso2.com/en/latest/security…	external
https://security.docs.wso2.com/en/latest/security…	external
https://security.docs.wso2.com/en/latest/security…	external
https://security.docs.wso2.com/en/latest/security…	external
https://security.docs.wso2.com/en/latest/security…	external
https://security.docs.wso2.com/en/latest/security…	external
https://security.docs.wso2.com/en/latest/security…	external
https://security.docs.wso2.com/en/latest/security…	external
https://security.docs.wso2.com/en/latest/security…	external
https://security.docs.wso2.com/en/latest/security…	external
https://security.docs.wso2.com/en/latest/security…	external
https://security.docs.wso2.com/en/latest/security…	external
https://security.docs.wso2.com/en/latest/security…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "WSO2 API Manager ist eine Open-Source-Plattform f\u00fcr das Management von APIs, die deren Erstellung, Ver\u00f6ffentlichung, Steuerung und Analyse erm\u00f6glicht.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in WSO2 API Manager ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuf\u00fchren, um seine Privilegien zu erh\u00f6hen, um beliebigen Programmcode auszuf\u00fchren, um einen SQL-Injection Angriff durchzuf\u00fchren, um einen Cross-Site Scripting Angriff durchzuf\u00fchren, um Informationen offenzulegen, und um Daten zu manipulieren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2085 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2085.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2085 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2085"
      },
      {
        "category": "external",
        "summary": "WSO2 Security Advisory vom 2026-06-25",
        "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4727/"
      },
      {
        "category": "external",
        "summary": "WSO2 Security Advisory vom 2026-06-25",
        "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/"
      },
      {
        "category": "external",
        "summary": "WSO2 Security Advisory vom 2026-06-25",
        "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4829/"
      },
      {
        "category": "external",
        "summary": "WSO2 Security Advisory vom 2026-06-25",
        "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4891/"
      },
      {
        "category": "external",
        "summary": "WSO2 Security Advisory vom 2026-06-25",
        "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4897/"
      },
      {
        "category": "external",
        "summary": "WSO2 Security Advisory vom 2026-06-25",
        "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5001/"
      },
      {
        "category": "external",
        "summary": "WSO2 Security Advisory vom 2026-06-25",
        "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5039/"
      },
      {
        "category": "external",
        "summary": "WSO2 Security Advisory vom 2026-06-25",
        "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5051/"
      },
      {
        "category": "external",
        "summary": "WSO2 Security Advisory vom 2026-06-25",
        "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5059/"
      },
      {
        "category": "external",
        "summary": "WSO2 Security Advisory vom 2026-06-25",
        "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5072/"
      },
      {
        "category": "external",
        "summary": "WSO2 Security Advisory vom 2026-06-25",
        "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5077/"
      },
      {
        "category": "external",
        "summary": "WSO2 Security Advisory vom 2026-06-25",
        "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/"
      },
      {
        "category": "external",
        "summary": "WSO2 Security Advisory vom 2026-06-25",
        "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5146/"
      },
      {
        "category": "external",
        "summary": "WSO2 Security Advisory vom 2026-06-25",
        "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/"
      },
      {
        "category": "external",
        "summary": "WSO2 Security Advisory vom 2026-06-25",
        "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5236/"
      },
      {
        "category": "external",
        "summary": "WSO2 Security Advisory vom 2026-06-25",
        "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/"
      }
    ],
    "source_lang": "en-US",
    "title": "WSO2 API Manager: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-07-20T22:00:00.000+00:00",
      "generator": {
        "date": "2026-07-21T06:48:31.696+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2085",
      "initial_release_date": "2026-06-25T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-06-25T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-06-28T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-39638"
        },
        {
          "date": "2026-07-06T22:00:00.000+00:00",
          "number": "3",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-41871"
        },
        {
          "date": "2026-07-20T22:00:00.000+00:00",
          "number": "4",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-45898, GHSA-VCJ5-R64M-JR4F"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Open Source WSO2 API Manager",
            "product": {
              "name": "Open Source WSO2 API Manager",
              "product_id": "T055842",
              "product_identification_helper": {
                "cpe": "cpe:/a:wso2:api_manager:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-13173",
      "product_status": {
        "known_affected": [
          "T055842"
        ]
      },
      "release_date": "2026-06-25T22:00:00.000+00:00",
      "title": "CVE-2025-13173"
    },
    {
      "cve": "CVE-2025-13394",
      "product_status": {
        "known_affected": [
          "T055842"
        ]
      },
      "release_date": "2026-06-25T22:00:00.000+00:00",
      "title": "CVE-2025-13394"
    },
    {
      "cve": "CVE-2025-5717",
      "product_status": {
        "known_affected": [
          "T055842"
        ]
      },
      "release_date": "2026-06-25T22:00:00.000+00:00",
      "title": "CVE-2025-5717"
    },
    {
      "cve": "CVE-2026-0637",
      "product_status": {
        "known_affected": [
          "T055842"
        ]
      },
      "release_date": "2026-06-25T22:00:00.000+00:00",
      "title": "CVE-2026-0637"
    },
    {
      "cve": "CVE-2026-1728",
      "product_status": {
        "known_affected": [
          "T055842"
        ]
      },
      "release_date": "2026-06-25T22:00:00.000+00:00",
      "title": "CVE-2026-1728"
    },
    {
      "cve": "CVE-2026-2053",
      "product_status": {
        "known_affected": [
          "T055842"
        ]
      },
      "release_date": "2026-06-25T22:00:00.000+00:00",
      "title": "CVE-2026-2053"
    },
    {
      "cve": "CVE-2026-2445",
      "product_status": {
        "known_affected": [
          "T055842"
        ]
      },
      "release_date": "2026-06-25T22:00:00.000+00:00",
      "title": "CVE-2026-2445"
    },
    {
      "cve": "CVE-2026-2613",
      "product_status": {
        "known_affected": [
          "T055842"
        ]
      },
      "release_date": "2026-06-25T22:00:00.000+00:00",
      "title": "CVE-2026-2613"
    },
    {
      "cve": "CVE-2026-3415",
      "product_status": {
        "known_affected": [
          "T055842"
        ]
      },
      "release_date": "2026-06-25T22:00:00.000+00:00",
      "title": "CVE-2026-3415"
    },
    {
      "cve": "CVE-2026-3418",
      "product_status": {
        "known_affected": [
          "T055842"
        ]
      },
      "release_date": "2026-06-25T22:00:00.000+00:00",
      "title": "CVE-2026-3418"
    },
    {
      "cve": "CVE-2026-4052",
      "product_status": {
        "known_affected": [
          "T055842"
        ]
      },
      "release_date": "2026-06-25T22:00:00.000+00:00",
      "title": "CVE-2026-4052"
    },
    {
      "cve": "CVE-2026-4249",
      "product_status": {
        "known_affected": [
          "T055842"
        ]
      },
      "release_date": "2026-06-25T22:00:00.000+00:00",
      "title": "CVE-2026-4249"
    },
    {
      "cve": "CVE-2026-5430",
      "product_status": {
        "known_affected": [
          "T055842"
        ]
      },
      "release_date": "2026-06-25T22:00:00.000+00:00",
      "title": "CVE-2026-5430"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-2445 (GCVE-0-2026-2445)

FKIE_CVE-2026-2445

GHSA-VCJ5-R64M-JR4F

WID-SEC-W-2026-2085

Tags

Sightings

Nomenclature