https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-4052/https://vulnfeed.org/cve/CVE-2026-4052/Tue, 03 Nov 2026 08:02:33 +0000This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.https://vulnfeed.org/cve/CVE-2026-2613/https://vulnfeed.org/cve/CVE-2026-2613/Mon, 02 Nov 2026 10:11:53 +0000The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.https://vulnfeed.org/cve/CVE-2025-11969/https://vulnfeed.org/cve/CVE-2025-11969/Mon, 02 Nov 2026 05:53:51 +0000The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. Successful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability.https://vulnfeed.org/cve/CVE-2025-14260/https://vulnfeed.org/cve/CVE-2025-14260/Wed, 28 Oct 2026 20:17:14 +0000Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on affected WSO2 Products. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem. This could potentially lead to unauthorized access to sensitive data and systems, regardless of whether these resources are located within a private network, as long as they are reachable by the WSO2 product.