Vendors / OSGeo

OSGeo vulnerabilities being exploited

1 OSGeo flaw was confirmed exploited in the wild in the past 365 days, across 1 product: GeoServer. If you run any of them, patch these first.

Added	Exploited vulnerability	Fix by
2025-12-11	CVE-2025-58360 GeoServer OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request.	2026-01-01

Watch my OSGeo software Scan a website All vendors

Source: CISA Known Exploited Vulnerabilities catalog 2026.10.29 (live). A listing means some versions are affected: check yours in the advisory. Guidance only.