geoserver vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20234
3. 202414
4. 20259
5. 20263

Known exploitedNewest addition to KEV first

• CVE-2025-58360

  GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

  geoserver · geoserver

  ExploitedHigh8.2
• CVE-2024-36401

  Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

  geoserver · geoserver

  ExploitedCritical9.8

Newest CVEs

• CVE-2025-58175

  GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution

  geoserver · org.geoserver.web:gs-web-app

  Medium6.5
• CVE-2025-52465

  GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page

  geoserver · org.geoserver.web:gs-web-app

  High7.2
• CVE-2025-27511

  GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

  geoserver · org.geoserver.extension:gs-db2

  High7.2
• CVE-2025-21621

  GeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format

  geoserver · geoserver

  Medium6.1
• CVE-2025-58360

  GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

  geoserver · geoserver

  ExploitedHigh8.2
• CVE-2025-30220

  GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling

  geoserver · geoserver

  Critical9.9
• CVE-2025-30145

  GeoServer has an Infinite Loop Vulnerability in Jiffle process

  geoserver · geoserver

  High7.5
• CVE-2025-27505

  GeoServer Missing Authorization on REST API Index

  geoserver · geoserver

  Medium5.3
• CVE-2024-40625

  GeoServer Coverage REST API Allows Server Side Request Forgery

  geoserver · geoserver

  Medium5.5
• CVE-2024-38524

  GWC Home Page communicate version and revision information

  geoserver · geoserver

  Medium5.3