https://pwn.watch/t/geoserver Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 11 Dec 2025 00:00:00 GMT https://pwn.watch/i/osgeo-geoserver-cve-2025-58360 https://pwn.watch/i/osgeo-geoserver-cve-2025-58360 Thu, 11 Dec 2025 00:00:00 GMT high <p>OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request. Added to CISA KEV on 2025-12-11.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2025-12-11: CISA added CVE-2025-58360 to the KEV catalog (due 2026-01-01).</li></ul> <p><strong>CVEs:</strong> CVE-2025-58360</p> https://pwn.watch/i/osgeo-geoserver-cve-2024-36401 https://pwn.watch/i/osgeo-geoserver-cve-2024-36401 Mon, 15 Jul 2024 00:00:00 GMT critical <p>OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input. Added to the CISA KEV catalog on 2024-07-15.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2024-07-15: CISA added CVE-2024-36401 to the KEV catalog (federal deadline 2024-08-05) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li><li>2024-07-01: CVE-2024-36401 published (<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-36401">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2024-36401</p>