Veille CVE

Mardi 29 septembre 2026

2 CVE

Critique 1 Élevée 0 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « WSO2 API Manager » ✕
  1. CVE-2025-6508 4.3 Moyenne

    WSO2 API Manager

    The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these overwritten API definitions. This could lead to the exposure of sensitive information or the initiation of unintended requests to backend services.

  2. CVE-2025-14561 9.0 Critique

    WSO2 API Manager · WSO2 API Control Plane · WSO2 Traffic Manager · WSO2 Universal Gateway

    In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.