Exploited vulnerabilities
OSGeo
3 OSGeo vulnerabilities in the CISA KEV catalogue: those for which the US cybersecurity agency has evidence of exploitation in real attacks.
In the catalogue3
Last 12 months1
In ransomware campaigns0
Last addition11 December 2025
The vulnerabilities3
- 11 December 2025CVE-2025-58360GeoServerOSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability
- 15 July 2024CVE-2024-36401GeoServerOSGeo GeoServer GeoTools Eval Injection Vulnerability
- 26 June 2024CVE-2022-24816JAI-EXTOSGeo GeoServer JAI-EXT Code Injection Vulnerability
Data: CISA Known Exploited Vulnerabilities (KEV) catalogue, last addition on 4 November 2026.
The catalogue lists only vulnerabilities with evidence of exploitation, not all of the vendor's vulnerabilities.
Alerts only on the products you use
With My Defence you receive alerts and briefings only on the products you use, OSGeo included.