OSGeo

Records62All Threatist records

Exploited (KEV)3In CISA KEV

CVSS critical18CVSS 9.0–10.0

CVSS high25CVSS 7.0–8.9

Exploited now

OSGeo records in CISA KEV

TI-2025-36149 OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability CRITICAL 99KEV 2025-12-11 TI-2024-24187 OSGeo GeoServer GeoTools Eval Injection Vulnerability CRITICAL 100KEV 2024-07-15 TI-2022-08629 OSGeo GeoServer JAI-EXT Code Injection Vulnerability CRITICAL 100KEV 2024-06-26

Components

Products in the NVD configurations · select one to filter the records

Mapserver 22 records HIGH Geoserver 16 records CRITICAL Gdal 12 records HIGH Geonetwork 4 records HIGH Owslib 2 records MEDIUM Pywps 1 record LOW Shapelib 1 record MEDIUM

Records

1 record in Pywps · all components

TI-2021-16736 CVE-2021-39371 · GHSA-p9wf-3xpg-c9g5

An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view…

LOW 36

An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the entity.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01524 Published 2021-08-23 Fixed in 4.5.0 CWE-611

Open these records in search →

Critical	18
High	25
Medium	18
Low	1
No CVSS	0