wso2 api control plane

Name: wso2 api control plane
Brand: wso2

productUS

cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

1critical9high5medium0low

updated 2026-10-28

vulnerabilities (31)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-5430US	—OT critical	22.4% (98th)	KEV	4.6.0.22	2026-08-06	2 versions
CVE-2025-3125US	high7.2	0.91% (60th)	—	no fix	2025-11-05	= 4.5.0
CVE-2025-5605US	medium5.3	0.85% (58th)	—	no fix	2025-10-24	= 4.5.0
CVE-2025-10611US	—OT elevated	0.82% (57th)	—	no fix	2025-10-16	= 4.5.0
CVE-2025-13590US	high7.2	0.77% (55th)	—	no fix	2026-02-19	2 versions
CVE-2025-9152US	—OT elevated	0.71% (53rd)	—	no fix	2025-10-16	= 4.5.0
CVE-2025-5717US	high7.2	0.69% (53rd)	—	no fix	2025-09-23	= 4.5.0
CVE-2025-15039US	—	0.67% (52nd)	—	4.6.0.9	2026-08-06	2 versions
CVE-2025-5350US	medium4.8	0.62% (49th)	—	no fix	2025-10-24	= 4.5.0
CVE-2025-10907US	high7.2	0.60% (48th)	—	no fix	2025-11-05	= 4.5.0
CVE-2025-9804US	medium6.5	0.56% (46th)	—	no fix	2025-10-16	= 4.5.0
CVE-2026-4249US	—	0.56% (46th)	—	4.5.0.55	2026-07-06	2 versions
CVE-2026-1728US	—	0.48% (41st)	—	4.6.0.13	2026-08-06	2 versions
CVE-2025-11093US	high7.2	0.47% (41st)	—	4.5.0.29	2025-11-05	4.5.0 → 4.5.0.29
CVE-2025-10713US	critical9.1	0.46% (39th)	—	no fix	2025-11-05	= 4.5.0
CVE-2024-6832US	high7.5	0.41% (36th)	—	no fix	2026-08-06	2 versions
CVE-2025-12737US	—	0.37% (31st)	—	4.5.0.36	2026-09-03	2 versions
CVE-2026-3416US	high7.5OT elevated	0.36% (29th)	—	4.5.0.53	2026-09-03	4.5.0 → 4.5.0.53
CVE-2024-10302US	medium5.8	0.29% (22nd)	—	no fix	2026-08-06	= 4.5.0
CVE-2026-2445US	—	0.25% (17th)	—	4.6.0.20	2026-07-20	2 versions
CVE-2025-8591US	—	0.25% (17th)	—	4.6.0.8	2026-07-06	2 versions
CVE-2025-9312US	—OT elevated	0.25% (16th)	—	no fix	2025-11-18	= 4.5.0
CVE-2025-6670US	—	0.25% (16th)	—	no fix	2025-11-18	2 versions
CVE-2025-5770US	—	0.21% (11th)	—	no fix	2025-11-05	= 4.5.0
CVE-2025-10853US	medium6.1	0.19% (9th)	—	no fix	2025-11-05	= 4.5.0
CVE-2024-8995US	—	0.19% (8th)	—	4.6.0.20	2026-08-06	2 versions
CVE-2025-4760US	—	0.19% (8th)	—	no fix	2025-09-23	= 4.5.0
CVE-2025-8154US	high7.5	0.19% (8th)	—	4.5.0.21	2026-05-11	4.5.0 → 4.5.0.21
CVE-2025-8325US	high8.8	0.17% (7th)	—	4.5.0.18	2026-05-11	4.5.0 → 4.5.0.18
CVE-2026-0637US	—	0.16% (5th)	—	4.6.0.14	2026-08-06	2 versions
CVE-2025-13394US	—	0.14% (3rd)	—	4.5.0.39	2026-08-06	2 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type3 CVEs
CWE-306Missing Authentication for Critical Function2 CVEs
CWE-352Cross-Site Request Forgery (CSRF)2 CVEs
CWE-693Protection Mechanism Failure2 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')2 CVEs
CWE-20Improper Input Validation1 CVEs
CWE-269Improper Privilege Management1 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE31 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan