OSGeo

Records62All Threatist records

Exploited (KEV)3In CISA KEV

CVSS critical18CVSS 9.0–10.0

CVSS high25CVSS 7.0–8.9

Exploited now

OSGeo records in CISA KEV

TI-2025-36149 OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability CRITICAL 99KEV 2025-12-11 TI-2024-24187 OSGeo GeoServer GeoTools Eval Injection Vulnerability CRITICAL 100KEV 2024-07-15 TI-2022-08629 OSGeo GeoServer JAI-EXT Code Injection Vulnerability CRITICAL 100KEV 2024-06-26

Components

Products in the NVD configurations · select one to filter the records

Mapserver 22 records HIGH Geoserver 16 records CRITICAL Gdal 12 records HIGH Geonetwork 4 records HIGH Owslib 2 records MEDIUM Pywps 1 record LOW Shapelib 1 record MEDIUM

Records

4 records in Geonetwork · all components

TI-2025-21556 CVE-2025-30220 · GHSA-jj54-8f66-c5pc

GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling

HIGH 77

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1CRITICAL 9.9 Network No auth No interaction EPSS 0.43616 Published 2025-06-10 Fixed in 2.27.1, 2.26.3 +1 CWE-611

TI-2022-26353 CVE-2022-50899 · GHSA-q595-r7rh-mc9h

Geonetwork 4.2.0 - XML External Entity (XXE)

MEDIUM 44

Geonetwork 3.10 through 4.2.0 contains an XML external entity vulnerability in PDF rendering that allows attackers to retrieve arbitrary files from the server.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00551 Published 2026-01-13 No fix listed CWE-611

TI-2021-09537 CVE-2021-28398

A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the…

LOW 35

A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to execute arbitrary OS commands remotely on the hosting infrastructure.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01457 Published 2022-09-05 No fix listed CWE-78

TI-2024-21128 CVE-2024-32037 · GHSA-52rf-25hq-5m33

GeoNetwork vulnerable to search end-point information disclosure in response headers

LOW 30

GeoNetwork is a catalog application to manage spatially referenced resources.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00377 Published 2025-02-11 Fixed in 4.2.10, 4.4.5 CWE-200

Open these records in search →