OSGeo

Records62All Threatist records

Exploited (KEV)3In CISA KEV

CVSS critical18CVSS 9.0–10.0

CVSS high25CVSS 7.0–8.9

Exploited now

OSGeo records in CISA KEV

TI-2025-36149 OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability CRITICAL 99KEV 2025-12-11 TI-2024-24187 OSGeo GeoServer GeoTools Eval Injection Vulnerability CRITICAL 100KEV 2024-07-15 TI-2022-08629 OSGeo GeoServer JAI-EXT Code Injection Vulnerability CRITICAL 100KEV 2024-06-26

Components

Products in the NVD configurations · select one to filter the records

Mapserver 22 records HIGH Geoserver 16 records CRITICAL Gdal 12 records HIGH Geonetwork 4 records HIGH Owslib 2 records MEDIUM Pywps 1 record LOW Shapelib 1 record MEDIUM

Records

2 records in Owslib · all components

TI-2023-12204 CVE-2023-27476 · GHSA-8h9c-r582-mggc

XML External Entity (XXE) Injection in OWSLib

MEDIUM 44

OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00977 Published 2023-03-07 Fixed in 0.28.1 CWE-611

TI-2021-16736 CVE-2021-39371 · GHSA-p9wf-3xpg-c9g5

An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view…

LOW 36

An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the entity.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01524 Published 2021-08-23 Fixed in 4.5.0 CWE-611

Open these records in search →

Critical	18
High	25
Medium	18
Low	1
No CVSS	0