Skip to content

RadicalNotion.AI

We do not sell or share your personal information

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Report Cards
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0

Platform

My Vulnerabilities
Insights
Notifications
Account
Pricing

Learn

All guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About us
Blog
Book a demo

Get Started

Sign up
Log in

Legal

Privacy
Terms

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities + report cards
VendorsVulnerabilities by vendor

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0

Resources

LearnPlain-English security guides
Data SourcesHow we source CVE data

About Us Blog Pricing Book a Demo

Log in

Home
Vendors
Wso2
Wso2 Open Banking Am

WSO2 Open Banking AM Vulnerabilities: CVEs, CISA KEV & Security Advisories

23 CVEs

1 in CISA KEV

WSO2 Open Banking AM Vulnerabilities

CVE security advisories and vulnerability history for WSO2 Open Banking AM by WSO2.

23

Total CVEs

Published

1

In CISA KEV

Exploited in the wild

1

Public exploits

With known exploit

7.0

Avg CVSS

2022–2026

Last updated April 16, 2026

Overview

WSO2 Open Banking AM has 23 published CVE records since 2022, of which 1 are in CISA's Known Exploited Vulnerabilities catalog and 1 have a known public exploit. The average CVSS base score across scored CVEs is 7.0.

This page aggregates every publicly disclosed vulnerability (CVE) affecting WSO2 Open Banking AM, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of WSO2 Open Banking AM's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical6

High4

Medium13

Low0

In CISA’s Known Exploited Vulnerabilities catalog

1

One of WSO2 Open Banking AM's CVEs is confirmed exploited in the wild.

Public exploits

1

One of WSO2 Open Banking AM's CVEs has a known public exploit available.

Affected versions and CVEs

Browse every WSO2 Open Banking AM version named in a CVE, then pick one to see only the CVEs that affect it.

Fixed in

Find a version

23 CVEs

Sort

XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service
CVE-2024-2374
Patch
CWE-611
High · CVSS 7.5
EPSS 0.0% (4th pct)2026-04-16
Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products
CVE-2025-9312
Patch
CWE-306
Critical · CVSS 9.8
EPSS 0.0% (15th pct)2025-11-18
Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services
CVE-2025-6670
Patch
CWE-352
High · CVSS 8.8
EPSS 0.0% (6th pct)2025-11-18
Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding
CVE-2025-10853
Patch
CWE-79
Medium · CVSS 5.2
EPSS 0.0% (8th pct)2025-11-05
Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)
CVE-2025-11093
Patch
CWE-94
High · CVSS 8.4
EPSS 0.1% (33th pct)2025-11-05
Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution
CVE-2025-10907
Patch
CWE-434
High · CVSS 8.4
EPSS 0.5% (67th pct)2025-11-05
XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration
CVE-2025-10713
Patch
CWE-611
Medium · CVSS 6.5
EPSS 0.1% (24th pct)2025-11-05
Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure
CVE-2025-5605
Patch
CWE-290
Medium · CVSS 4.3
EPSS 6.2% (91th pct)2025-10-24
SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products
CVE-2025-5350
Patch
CWE-918
Medium · CVSS 5.9
EPSS 0.7% (71th pct)2025-10-24
Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
CVE-2025-9804
Patch
CWE-284
Critical · CVSS 9.6
EPSS 0.0% (10th pct)2025-10-16
Potential Broken Access Control in Multiple WSO2 Products via System REST APIs
CVE-2025-10611
Patch
CWE-863
Critical · CVSS 9.8
EPSS 0.2% (38th pct)2025-10-16
Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service
CVE-2025-5717
Patch
CWE-94
Medium · CVSS 6.8
EPSS 0.6% (71th pct)2025-09-23
Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files
CVE-2024-3511
Patch
CWE-863
Medium · CVSS 4.3
EPSS 0.1% (35th pct)2025-06-23
Open Redirection in Multiple WSO2 Products via Multi-Option Authentication Endpoint
CVE-2024-1440
Patch
CWE-601
Medium · CVSS 5.4
EPSS 0.1% (35th pct)2025-06-02
Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation
CVE-2024-8008
Patch
CWE-79
Medium · CVSS 5.2
EPSS 0.1% (24th pct)2025-06-02
Medium vulnerability · 2025-06-02
CVE-2024-3509
Patch
CWE-79
Medium · CVSS 4.3
EPSS 0.1% (24th pct)2025-06-02
Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution
CVE-2024-7074
Patch
CWE-434
Medium · CVSS 6.8
EPSS 3.5% (88th pct)2025-06-02
Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup
CVE-2024-7097
Patch
CWE-863
Medium · CVSS 4.3
EPSS 25.1% (96th pct)2025-05-30
Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw
CVE-2024-7096
Patch
CWE-863
Medium · CVSS 4.2
EPSS 0.2% (42th pct)2025-05-30
Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover
CVE-2024-6914
Patch
CWE-863
Critical · CVSS 9.8
EPSS 0.5% (68th pct)2025-05-22
An XML External Entity (XXE) vulnerability in Multiple WSO2 Products
CVE-2025-2905
Patch
CWE-611
Critical · CVSS 9.1
EPSS 0.1% (33th pct)2025-05-05
Medium vulnerability · 2025-02-27
CVE-2024-5848
Patch
CWE-79
Medium · CVSS 6.1
EPSS 0.3% (53th pct)2025-02-27
Critical vulnerability · 2022-04-18
CVE-2022-29464
CISA KEV
Public exploit
CWE-22
Added to CISA KEV 2022-04-25
Critical · CVSS 9.3
EPSS 94.4% (100th pct)2022-04-18

Common weakness types

The CWE weakness categories most often found in WSO2 Open Banking AM CVEs. Follow any weakness for its full explanation.

CWE-863Incorrect Authorization5 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')4 CVEs
CWE-611Improper Restriction of XML External Entity Reference3 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type2 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')2 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1 CVE
CWE-918Server-Side Request Forgery (SSRF)1 CVE
CWE-601URL Redirection to Untrusted Site ('Open Redirect')1 CVE

Disclosure activity by year

How many WSO2 Open Banking AM CVEs were published each year.

2022

1

2025

21

2026

1

Other WSO2 products

Browse vulnerabilities for other products by WSO2.

api manager78 CVEs identity server67 CVEs product-apim56 CVEs WSO2 API Manager45 CVEs WSO2 Identity Server44 CVEs identity server as key manager42 CVEs enterprise integrator32 CVEs WSO2 Identity Server as Key Manager28 CVEs

All WSO2 vulnerabilities

Frequently asked questions

Common questions about WSO2 Open Banking AM vulnerabilities.

How many CVEs does WSO2 WSO2 Open Banking AM have?

WSO2 WSO2 Open Banking AM has 23 published CVE records since 2022.

How many WSO2 WSO2 Open Banking AM CVEs are in CISA KEV?

Yes — 1 of WSO2 WSO2 Open Banking AM's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Are there public exploits for WSO2 WSO2 Open Banking AM vulnerabilities?

Yes — 1 of WSO2 WSO2 Open Banking AM's CVEs have a known public exploit.

Which versions of WSO2 WSO2 Open Banking AM are affected?

31 distinct WSO2 WSO2 Open Banking AM versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in WSO2 WSO2 Open Banking AM CVEs?

WSO2 WSO2 Open Banking AM's CVEs most often map to these CWE weakness types: CWE-863 (Incorrect Authorization), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-611 (Improper Restriction of XML External Entity Reference), CWE-434 (Unrestricted Upload of File with Dangerous Type).

How many critical WSO2 WSO2 Open Banking AM vulnerabilities are there?

WSO2 WSO2 Open Banking AM has 6 critical and 4 high-severity CVEs.

What is the average severity of WSO2 WSO2 Open Banking AM CVEs?

The average CVSS base score across WSO2 WSO2 Open Banking AM's scored CVEs is 7.0.

References

All WSO2 vulnerabilities
The MITRE CVE Program (opens in a new tab)
Learn: What is a CVE?
CWE directory: the weakness types these CVEs map to

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track WSO2 Open Banking AM vulnerabilities

Monitor new WSO2 Open Banking AM vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

On this page

Overview
Severity and exploitation
Affected versions and CVEs
Common weakness types
Disclosure activity
Other products
FAQ
References