Open Source Geospatial Foundation (OSGeo) GeoServer

Name: Open Source Geospatial Foundation (OSGeo) GeoServer
Brand: Open Source Geospatial Foundation (OSGeo)

productRU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

5critical5high1medium0low

updated 2026-10-28

vulnerabilities (15)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2024-36401US	critical9.8OT critical	99.8% (100th)	KEV	no fix	2024-07-01	3 versions
CVE-2025-58360US	critical9.8OT critical	61.2% (99th)	KEV	no fix	2025-11-25	2 versions
CVE-2023-25157US	critical9.8	85.2% (100th)	Exploit	no fix	2023-02-21	5 versions
CVE-2024-36404US	—	76.1% (100th)	—	no fix	2024-07-02	2.22.0 → 2.22.5
CVE-2023-35042US	critical9.8	44.8% (99th)	—	no fix	2023-06-12	—
CVE-2025-30220US	critical9.1	42.3% (99th)	—	no fix	2025-06-10	3 versions
CVE-2024-29198US	high8.2	2.30% (83rd)	—	no fix	2025-06-10	2 versions
CVE-2022-24847US	high7.2	1.56% (75th)	—	no fix	2022-04-13	2 versions
CVE-2024-24749US	high7.5	0.76% (55th)	—	no fix	2024-07-01	2 versions
CVE-2025-52465US	—	0.62% (49th)	—	no fix	2026-06-18	2 versions
CVE-2024-38524US	high7.5	0.44% (38th)	—	no fix	2025-06-10	2 versions
CVE-2024-40625US	medium4.9	0.37% (31st)	—	no fix	2025-06-10	≤ 2.26.0
CVE-2025-21621US	—	0.32% (24th)	—	no fix	2025-11-25	≤ 2.25.0
CVE-2024-34711US	high8.2	0.30% (22nd)	—	no fix	2025-06-10	≤ 2.25.0

showing 14 of 15

The flaw types (CWEs) most of these CVEs share.

CWE-918Server-Side Request Forgery (SSRF)4 CVEs
CWE-20Improper Input Validation3 CVEs
CWE-611Improper Restriction of XML External Entity Reference3 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor2 CVEs
CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')2 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1 CVEs
CWE-73External Control of File Name or Path1 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.