CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,149 CVEs published, 232 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,149
Show in the list
Critical, last 7 days
232
Show in the list
Healthcare-tagged, last 7 days
10
Show in the list
Known exploited (CISA KEV)
1,762
Show in the list

Showing CVEs that name the product wso2:traffic_manager. Show all products

36 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2026-3583Low 3.1Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
Assigned by WSO2
Oct 28, 2026
CVE-2025-13173Medium 6.5Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination
Assigned by WSO2
Oct 19, 2026
CVE-2025-7203Medium 4.9Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials
Assigned by WSO2
Oct 19, 2026
CVE-2025-6623Medium 4.3Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection
Assigned by WSO2
Oct 19, 2026
CVE-2025-5802Medium 5.3Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery
Assigned by WSO2
Sep 15, 2026
CVE-2025-12737High 8.4Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution
Assigned by WSO2
Sep 3, 2026
CVE-2026-3418Critical 9.1Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
Assigned by WSO2
Aug 6, 2026
CVE-2026-3415High 8.7XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service
Assigned by WSO2
Aug 6, 2026
CVE-2025-14561Critical 9.0Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations
Assigned by WSO2
Aug 6, 2026
CVE-2026-5430
Known exploited
Critical 10.0Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
Assigned by WSO2
Aug 6, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.