Vulnerabilities

TI-2025-35983 CVE-2025-58175 · GHSA-x4r9-gmw3-hxww

GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution

LOW 35

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00287 Published 2026-06-18 Fixed in 2.26.4, 2.27.3 CWE-20

TI-2025-32593 CVE-2025-52465 · GHSA-7qmg-grcp-qf25

GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page

LOW 35

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00616 Published 2026-06-18 Fixed in 2.26.4, 2.27.3 CWE-73

TI-2025-20343 CVE-2025-27511 · GHSA-g628-r368-6vh7

GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

LOW 36

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01074 Published 2026-06-18 Fixed in 2.27.0 CWE-502

TI-2025-21556 CVE-2025-30220 · GHSA-jj54-8f66-c5pc

GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling

HIGH 77

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1CRITICAL 9.9 Network No auth No interaction EPSS 0.43616 Published 2025-06-10 Fixed in 2.27.1, 2.26.3 +1 CWE-611

TI-2025-21485 CVE-2025-30145 · GHSA-gr67-pwcv-76gf

GeoServer has an Infinite Loop Vulnerability in Jiffle process

MEDIUM 40

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00534 Published 2025-06-10 Fixed in 2.26.3, 2.25.7 CWE-835

TI-2025-20337 CVE-2025-27505 · GHSA-h86g-x8mm-78m5

GeoServer Missing Authorization on REST API Index

LOW 32

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01165 Published 2025-06-10 Fixed in 2.26.3, 2.25.6 CWE-862

TI-2024-27037 CVE-2024-40625 · GHSA-r4hf-r8gj-jgw2

GeoServer Coverage REST API Allows Server Side Request Forgery

LOW 25

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00385 Published 2025-06-10 Fixed in 2.26.0 CWE-918

TI-2024-25759 CVE-2024-38524 · GHSA-jm79-7xhw-6f6f

GWC Home Page communicate version and revision information

LOW 39

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0046 Published 2025-06-10 Fixed in 2.26.2, 2.25.6 CWE-200

TI-2024-23008 CVE-2024-34711 · GHSA-mc43-4fqr-c965

GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)

MEDIUM 46

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00311 Published 2025-06-10 Fixed in 2.25.0 CWE-200

TI-2024-19367 CVE-2024-29198 · GHSA-5gw5-jccf-6hxw

GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost

MEDIUM 40

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.02321 Published 2025-06-10 Fixed in 2.24.4, 2.25.2 CWE-918

TI-2024-23300 CVE-2024-35230 · GHSA-6pfc-w86r-54q6

Welcome and About GeoServer pages communicate version and revision information

MEDIUM 63

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00697 Published 2024-12-16 Fixed in 2.26.0, 2.25.1 CWE-200

TI-2023-23486 CVE-2023-43795 · GHSA-5pr3-m5hm-9956

WPS Server Side Request Forgery in GeoServer

CRITICAL 85

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.69028 Published 2023-10-24 Fixed in 2.22.5, 2.23.2 CWE-918

TI-2023-21939 CVE-2023-41339 · GHSA-cqpc-x2c6-2gmf

Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer

MEDIUM 44

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00632 Published 2023-10-24 Fixed in 2.22.5, 2.23.2 CWE-918

TI-2023-10619 CVE-2023-25157 · GHSA-7g5f-wrx8-5ccf

Unfiltered SQL Injection Vulnerabilities in Geoserver

CRITICAL 90

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.85247 Published 2023-02-21 Fixed in 2.22.2, 2.21.4 CWE-89

TI-2021-17747 CVE-2021-40822 · GHSA-rr33-j5p5-ppf8

GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.

MEDIUM 51

GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.19259 Published 2022-05-01 No fix listed CWE-918

TI-2022-08659 CVE-2022-24847 · GHSA-4pm3-f52j-8ggh

Improper Input Validation in GeoServer

LOW 37

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0156 Published 2022-04-13 Fixed in 2.20.4, 2.19.6 CWE-20

Vulnerabilities

Filters