Brand
OSGeo: actively exploited vulnerabilities
3 vulnerabilities in OSGeo products (GeoServer) are in CISA’s catalog of exploited vulnerabilities. Last added: December 11, 2025.
-
1 vulnerability added in the last 12 months
-
3 exploited vulnerabilities in the catalog, in total
-
0 added in the last 30 days
By category
Add just one OSGeo category to your radar, or open its page.
- ERP, business applications and databases 3 vulnerabilities
A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.
Affected products
- GeoServer3 vulnerabilities, Business apps and data
Name used by CISA: OSGeo. Product families: indicative classification by this site.
Patch first
In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this OSGeo list.
- Rank 1
OSGeo GeoServerCVE-2025-58360
OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability
CVSS severity 9.8critical
Added Dec 11, 2025
- Rank 2
OSGeo GeoServerCVE-2022-24816
OSGeo GeoServer JAI-EXT Code Injection Vulnerability
CVE from 2022, added in 2024
CVSS severity 10.0critical
Added Jun 26, 2024
- Rank 3
OSGeo GeoServerCVE-2024-36401
OSGeo GeoServer GeoTools Eval Injection Vulnerability
CVSS severity 9.8critical
Added Jul 15, 2024
Follow and verify
Indicative classification, based on the vendor and product names given by CISA. How products are classified.