Vulnerabilities

TI-2025-35983 CVE-2025-58175 · GHSA-x4r9-gmw3-hxww

GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution

LOW 35

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00287 Published 2026-06-18 Fixed in 2.26.4, 2.27.3 CWE-20

TI-2025-32593 CVE-2025-52465 · GHSA-7qmg-grcp-qf25

GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page

LOW 35

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00616 Published 2026-06-18 Fixed in 2.26.4, 2.27.3 CWE-73

TI-2025-20343 CVE-2025-27511 · GHSA-g628-r368-6vh7

GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

LOW 36

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01074 Published 2026-06-18 Fixed in 2.27.0 CWE-502

TI-2025-15581 CVE-2025-21621 · GHSA-w66h-j855-qr72

GeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format

LOW 27

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00317 Published 2025-11-25 Fixed in 2.25.0 CWE-79

TI-2025-36149 CVE-2025-58360 · GHSA-fjf5-xgmq-5525

GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

CRITICAL 99KEV

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.61169 Published 2025-11-25 Fixed in 2.26.2, 2.25.6 CWE-611

TI-2025-21556 CVE-2025-30220 · GHSA-jj54-8f66-c5pc

GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling

HIGH 77

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1CRITICAL 9.9 Network No auth No interaction EPSS 0.43616 Published 2025-06-10 Fixed in 2.27.1, 2.26.3 +1 CWE-611

TI-2025-21485 CVE-2025-30145 · GHSA-gr67-pwcv-76gf

GeoServer has an Infinite Loop Vulnerability in Jiffle process

MEDIUM 40

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00534 Published 2025-06-10 Fixed in 2.26.3, 2.25.7 CWE-835

TI-2025-20337 CVE-2025-27505 · GHSA-h86g-x8mm-78m5

GeoServer Missing Authorization on REST API Index

LOW 32

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01165 Published 2025-06-10 Fixed in 2.26.3, 2.25.6 CWE-862

TI-2024-27037 CVE-2024-40625 · GHSA-r4hf-r8gj-jgw2

GeoServer Coverage REST API Allows Server Side Request Forgery

LOW 25

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00385 Published 2025-06-10 Fixed in 2.26.0 CWE-918

TI-2024-25759 CVE-2024-38524 · GHSA-jm79-7xhw-6f6f

GWC Home Page communicate version and revision information

LOW 39

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0046 Published 2025-06-10 Fixed in 2.26.2, 2.25.6 CWE-200

TI-2024-23008 CVE-2024-34711 · GHSA-mc43-4fqr-c965

GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)

MEDIUM 46

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00311 Published 2025-06-10 Fixed in 2.25.0 CWE-200

TI-2024-19367 CVE-2024-29198 · GHSA-5gw5-jccf-6hxw

GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost

MEDIUM 40

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.02321 Published 2025-06-10 Fixed in 2.24.4, 2.25.2 CWE-918

TI-2024-23300 CVE-2024-35230 · GHSA-6pfc-w86r-54q6

Welcome and About GeoServer pages communicate version and revision information

MEDIUM 63

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00697 Published 2024-12-16 Fixed in 2.26.0, 2.25.1 CWE-200

TI-2024-24187 CVE-2024-36401 · GHSA-6jj6-gm7p-fcvv

Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

CRITICAL 100KEV

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99813 Published 2024-07-01 Fixed in 2.23.6, 2.24.4 +2 CWE-95

TI-2024-22995 CVE-2024-34696 · GHSA-j59v-vgcr-hxvf

GeoServer's Server Status shows sensitive environmental variables and Java properties

LOW 23

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00397 Published 2024-07-01 Fixed in 2.24.4, 2.25.1 CWE-200

TI-2024-16266 CVE-2024-24749 · GHSA-jhqx-5v5g-mpf3

Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat

MEDIUM 40

GeoServer is an open source server that allows users to share and edit geospatial data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00756 Published 2024-07-01 Fixed in 2.23.5, 2.24.3 CWE-22

TI-2024-15815 CVE-2024-23821 · GHSA-88wc-fcj9-q3r9

GeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS)

LOW 22

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00405 Published 2024-03-20 Fixed in 2.23.4, 2.24.1 CWE-79

TI-2024-15813 CVE-2024-23819 · GHSA-7x76-57fr-m5r5

GeoServer Stored Cross-Site Scripting (XSS) vulnerability in MapML HTML Page

LOW 22

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00426 Published 2024-03-20 Fixed in 2.23.4, 2.24.1 CWE-79

TI-2024-15812 CVE-2024-23818 · GHSA-fcpm-hchj-mh72

GeoServer Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers Format

LOW 22

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00426 Published 2024-03-20 Fixed in 2.23.3, 2.24.1 CWE-79

TI-2024-15662 CVE-2024-23643 · GHSA-56r3-f536-5gf7

GeoServer Stored Cross-Site Scripting (XSS) vulnerability in GWC Seed Form

MEDIUM 55

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00426 Published 2024-03-20 Fixed in 2.23.2, 2.24.1 CWE-79

TI-2024-15661 CVE-2024-23642 · GHSA-fg9v-56hw-g525

GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG Renderer

LOW 22

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00426 Published 2024-03-20 Fixed in 2.23.4, 2.24.1 CWE-79

TI-2024-15659 CVE-2024-23640 · GHSA-9rfr-pf2x-g4xf

GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Style Publisher

LOW 22

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00426 Published 2024-03-20 Fixed in 2.23.3 CWE-79

TI-2024-15653 CVE-2024-23634 · GHSA-75m5-hh4r-q9gx

GeoServer arbitrary file renaming vulnerability in REST Coverage/Data Store API

LOW 28

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1MEDIUM 6.0 Network High privileges No interaction EPSS 0.00694 Published 2024-03-20 Fixed in 2.23.5, 2.24.2 CWE-20

TI-2023-28099 CVE-2023-51445 · GHSA-fh7p-5f6g-vj2w

GeoServer Stored Cross-Site Scripting (XSS) vulnerability in REST Resources API

MEDIUM 55

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00487 Published 2024-03-20 Fixed in 2.23.3 CWE-79

TI-2023-28098 CVE-2023-51444 · GHSA-9v5q-2gwq-q9hq

GeoServer arbitrary file upload vulnerability in REST Coverage Store API

HIGH 67

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01867 Published 2024-03-20 Fixed in 2.23.4, 2.24.1 CWE-20

Vulnerabilities

Filters