OSGeo known exploited vulnerabilities
CISA's Known Exploited Vulnerabilities catalog lists 3 OSGeo vulnerabilities: 1 added in the last 365 days, 2 rated critical (CVSS 9 or higher), and 0 with known ransomware use. The most recent was added Dec 11, 2025.
RSS feed for OSGeo exploited vulnerabilities · Search them on KEVWire · Ask your AI assistant
| Added to KEV | CVE | Vulnerability | CVSS | EPSS | Federal due date | Ransomware use |
|---|---|---|---|---|---|---|
| 2025-12-11 | CVE-2025-58360 | OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability | 8.2 (v3.1) | 61.2% | 2026-01-01 | Unknown |
| 2024-07-15 | CVE-2024-36401 | OSGeo GeoServer GeoTools Eval Injection Vulnerability | 9.8 (v3.1) | 99.8% | 2024-08-05 | Unknown |
| 2024-06-26 | CVE-2022-24816 | OSGeo GeoServer JAI-EXT Code Injection Vulnerability | 10 (v3.1) | >99.9% | 2024-07-17 | Unknown |