geoserver geoserver

Name: geoserver geoserver
Brand: geoserver

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

5critical7high12medium0low

updated 2026-10-28

vulnerabilities (27)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2024-36401US	critical9.8OT critical	99.8% (100th)	KEV	2.24.4	2024-07-01	4 versions
CVE-2025-58360US	critical9.8OT critical	61.2% (99th)	KEV	2.26.2	2025-11-25	3 versions
CVE-2023-25157US	critical9.8	85.2% (100th)	Exploit	2.22.2	2023-02-21	2 versions
CVE-2023-43795US	critical9.8	69.0% (99th)	—	2.23.2	2023-10-25	2 versions
CVE-2025-30220US	critical9.1	42.3% (99th)	—	2.26.3	2025-06-10	5 versions
CVE-2024-29198US	high8.2	2.30% (83rd)	—	2.24.4	2025-06-10	2 versions
CVE-2023-51444US	high7.2	1.87% (79th)	—	no fix	2024-03-20	3 versions
CVE-2022-24847US	high7.2	1.56% (75th)	—	2.20.4	2022-04-13	2 versions
CVE-2025-27505US	—OT elevated	1.15% (67th)	—	2.26.3	2025-06-10	2 versions
CVE-2023-41877US	high7.2	0.84% (58th)	—	no fix	2024-03-20	≤ ≤ 2.23.4
CVE-2024-24749US	high7.5	0.76% (55th)	—	2.24.3	2024-07-01	2 versions
CVE-2024-35230US	medium5.3	0.70% (53rd)	—	2.26.0	2024-12-16	2.0.0, → 2.26.0
CVE-2024-23634US	medium6.0	0.69% (53rd)	—	2.24.2	2024-03-20	3 versions
CVE-2023-41339US	medium5.3	0.63% (50th)	—	2.23.2	2023-10-25	2 versions
CVE-2025-30145US	—	0.51% (43rd)	—	2.26.3	2025-06-10	2 versions
CVE-2023-51445US	medium4.8	0.49% (42nd)	—	no fix	2024-03-20	2 versions
CVE-2024-38524US	high7.5	0.44% (38th)	—	2.26.2	2025-06-10	2 versions
CVE-2024-23819US	medium4.8	0.43% (37th)	—	no fix	2024-03-20	3 versions
CVE-2024-23818US	medium4.8	0.43% (37th)	—	no fix	2024-03-20	3 versions
CVE-2024-23643US	medium4.8	0.43% (37th)	—	no fix	2024-03-20	3 versions
CVE-2024-23642US	medium4.8	0.43% (37th)	—	no fix	2024-03-20	3 versions
CVE-2024-23640US	medium4.8	0.43% (37th)	—	no fix	2024-03-20	2 versions
CVE-2024-23821US	medium4.8	0.40% (35th)	—	no fix	2024-03-20	3 versions
CVE-2024-34696US	medium4.9	0.40% (34th)	—	2.24.4	2024-07-01	2 versions
CVE-2024-40625US	medium4.9	0.37% (31st)	—	no fix	2025-06-10	≤ < 2.26.0
CVE-2025-21621US	—	0.32% (24th)	—	no fix	2025-11-25	≤ < 2.25.0
CVE-2024-34711US	high8.2	0.30% (22nd)	—	no fix	2025-06-10	≤ < 2.25.0

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')8 CVEs
CWE-918Server-Side Request Forgery (SSRF)6 CVEs
CWE-20Improper Input Validation4 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor4 CVEs
CWE-611Improper Restriction of XML External Entity Reference3 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type1 CVEs
CWE-73External Control of File Name or Path1 CVEs

sources (2)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)27 CVEs
NLNCSC-NL (CSAF)2 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan