Skip to content

Exploit Radar Choose my productsProducts My radar

Products › Brands

Brand

OSGeo: actively exploited vulnerabilities

3 vulnerabilities in OSGeo products (GeoServer) are in CISA’s catalog of exploited vulnerabilities. Last added: December 11, 2025.

1 vulnerability added in the last 12 months
3 exploited vulnerabilities in the catalog, in total
0 added in the last 30 days

By category

Add just one OSGeo category to your radar, or open its page.

ERP, business applications and databases 3 vulnerabilities

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

GeoServer 3 vulnerabilities · Business apps and data

Name used by CISA: OSGeo. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this OSGeo list.

Rank 1OSGeo GeoServer
CVE-2025-58360
OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability
Added in the last 12 months: ranked by severity.
Added
Dec 11, 2025
CISA deadline
21 days
CVSS severity
9.8 (critical)
Rank 2OSGeo GeoServer
CVE-2022-24816
CVE from 2022, added in 2024
OSGeo GeoServer JAI-EXT Code Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
Jun 26, 2024
CISA deadline
21 days
CVSS severity
10.0 (critical)
Rank 3OSGeo GeoServer
CVE-2024-36401
OSGeo GeoServer GeoTools Eval Injection Vulnerability
Added more than a year ago: ranked by severity.
Added
Jul 15, 2024
CISA deadline
21 days
CVSS severity
9.8 (critical)

Indicative classification, based on the vendor and product names given by CISA. How products are classified.