org.geoserver:gs-wfs (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package org.geoserver:gs-wfs, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (4)

• CVE-2025-30220 — CVSS 9.9 (critical): GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to…
• CVE-2023-35042 — CVSS 9.8 (critical): GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in…
• CVE-2024-36401 — CVSS 9.8 (critical) — actively exploited: GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and…
• CVE-2024-29198 — CVSS 7.5 (high): GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve…