geoserver

Records34All Threatist records

Exploited (KEV)2In CISA KEV

CVSS critical8CVSS 9.0–10.0

CVSS high12CVSS 7.0–8.9

Exploited now

geoserver records in CISA KEV

TI-2025-36149 OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability CRITICAL 99KEV 2025-12-11 TI-2024-24187 OSGeo GeoServer GeoTools Eval Injection Vulnerability CRITICAL 100KEV 2024-07-15

Components

Products in the NVD configurations · select one to filter the records

Geoserver 17 records CRITICAL Geowebcache 2 records MEDIUM

Records

34 records

TI-2024-24187 CVE-2024-36401 · GHSA-6jj6-gm7p-fcvv

Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

CRITICAL 100KEV

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99813 Published 2024-07-01 Fixed in 2.23.6, 2.24.4 +2 CWE-95

TI-2025-36149 CVE-2025-58360 · GHSA-fjf5-xgmq-5525

GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

CRITICAL 99KEV

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.61169 Published 2025-11-25 Fixed in 2.26.2, 2.25.6 CWE-611

TI-2023-10619 CVE-2023-25157 · GHSA-7g5f-wrx8-5ccf

Unfiltered SQL Injection Vulnerabilities in Geoserver

CRITICAL 90

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.85247 Published 2023-02-21 Fixed in 2.22.2, 2.21.4 CWE-89

TI-2023-23486 CVE-2023-43795 · GHSA-5pr3-m5hm-9956

WPS Server Side Request Forgery in GeoServer

CRITICAL 85

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.69028 Published 2023-10-24 Fixed in 2.22.5, 2.23.2 CWE-918

TI-2023-17518 CVE-2023-35042 · GHSA-59x6-g4jr-4hxc

GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code…

HIGH 78

GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as exploited in the wild in June 2023.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.44825 Published 2023-06-12 Fixed in 2.18.6, 2.19.6 +1

TI-2025-21556 CVE-2025-30220 · GHSA-jj54-8f66-c5pc

GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling

HIGH 77

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1CRITICAL 9.9 Network No auth No interaction EPSS 0.43616 Published 2025-06-10 Fixed in 2.27.1, 2.26.3 +1 CWE-611

TI-2023-28098 CVE-2023-51444 · GHSA-9v5q-2gwq-q9hq

GeoServer arbitrary file upload vulnerability in REST Coverage Store API

HIGH 67

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01867 Published 2024-03-20 Fixed in 2.23.4, 2.24.1 CWE-20

TI-2024-23300 CVE-2024-35230 · GHSA-6pfc-w86r-54q6

Welcome and About GeoServer pages communicate version and revision information

MEDIUM 63

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00697 Published 2024-12-16 Fixed in 2.26.0, 2.25.1 CWE-200

TI-2024-15662 CVE-2024-23643 · GHSA-56r3-f536-5gf7

GeoServer Stored Cross-Site Scripting (XSS) vulnerability in GWC Seed Form

MEDIUM 55

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00426 Published 2024-03-20 Fixed in 2.23.2, 2.24.1 CWE-79

TI-2023-28099 CVE-2023-51445 · GHSA-fh7p-5f6g-vj2w

GeoServer Stored Cross-Site Scripting (XSS) vulnerability in REST Resources API

MEDIUM 55

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00487 Published 2024-03-20 Fixed in 2.23.3 CWE-79

TI-2024-23008 CVE-2024-34711 · GHSA-mc43-4fqr-c965

GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)

MEDIUM 46

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00311 Published 2025-06-10 Fixed in 2.25.0 CWE-200

TI-2023-05323 CVE-2023-5786 · GHSA-382v-j99g-hw2p

GeoServer GeoWebCache rest.html direct request

MEDIUM 46

A vulnerability was found in GeoServer GeoWebCache up to 1.15.1.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00968 Published 2023-10-26 No fix listed CWE-425

TI-2023-21939 CVE-2023-41339 · GHSA-cqpc-x2c6-2gmf

Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer

MEDIUM 44

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00632 Published 2023-10-24 Fixed in 2.22.5, 2.23.2 CWE-918

TI-2022-08658 CVE-2022-24846

Unchecked JNDI lookups in GeoWebCache

MEDIUM 44

GeoWebCache is a tile caching server implemented in Java.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01296 Published 2022-04-14 Fixed in 1.20.2, 1.19.3 CWE-20

TI-2025-21485 CVE-2025-30145 · GHSA-gr67-pwcv-76gf

GeoServer has an Infinite Loop Vulnerability in Jiffle process

MEDIUM 40

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00534 Published 2025-06-10 Fixed in 2.26.3, 2.25.7 CWE-835

TI-2024-19367 CVE-2024-29198 · GHSA-5gw5-jccf-6hxw

GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost

MEDIUM 40

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.02321 Published 2025-06-10 Fixed in 2.24.4, 2.25.2 CWE-918

TI-2024-16266 CVE-2024-24749 · GHSA-jhqx-5v5g-mpf3

Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat

MEDIUM 40

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00756 Published 2024-07-01 Fixed in 2.23.5, 2.24.3 CWE-22

TI-2024-25759 CVE-2024-38524 · GHSA-jm79-7xhw-6f6f

GWC Home Page communicate version and revision information

LOW 39

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0046 Published 2025-06-10 Fixed in 2.26.2, 2.25.6 CWE-200

TI-2022-08659 CVE-2022-24847 · GHSA-4pm3-f52j-8ggh

Improper Input Validation in GeoServer

LOW 37

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0156 Published 2022-04-13 Fixed in 2.20.4, 2.19.6 CWE-20

TI-2025-20343 CVE-2025-27511 · GHSA-g628-r368-6vh7

GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

LOW 36

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01074 Published 2026-06-18 Fixed in 2.27.0 CWE-502

TI-2025-35983 CVE-2025-58175 · GHSA-x4r9-gmw3-hxww

GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution

LOW 35

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00287 Published 2026-06-18 Fixed in 2.26.4, 2.27.3 CWE-20

TI-2025-32593 CVE-2025-52465 · GHSA-7qmg-grcp-qf25

GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page

LOW 35

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00616 Published 2026-06-18 Fixed in 2.26.4, 2.27.3 CWE-73

TI-2023-22270 CVE-2023-41877 · GHSA-8g7v-vjrc-x4g5

GeoServer log file path traversal vulnerability

LOW 35

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00841 Published 2024-03-20 No fix listed CWE-22

TI-2025-20337 CVE-2025-27505 · GHSA-h86g-x8mm-78m5

GeoServer Missing Authorization on REST API Index

LOW 32

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01165 Published 2025-06-10 Fixed in 2.26.3, 2.25.6 CWE-862

TI-2024-15653 CVE-2024-23634 · GHSA-75m5-hh4r-q9gx

GeoServer arbitrary file renaming vulnerability in REST Coverage/Data Store API

LOW 28

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1MEDIUM 6.0 Network High privileges No interaction EPSS 0.00694 Published 2024-03-20 Fixed in 2.23.5, 2.24.2 CWE-20

Open these records in search →