org.geoserver:gs-wms (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package org.geoserver:gs-wms, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (8)

• CVE-2023-35042 — CVSS 9.8 (critical): GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in…
• CVE-2024-36401 — CVSS 9.8 (critical) — actively exploited: GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and…
• CVE-2023-41339 — CVSS 8.6 (high): GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The WMS specification…
• CVE-2025-58360 — CVSS 8.2 (high) — actively exploited: GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before…
• CVE-2025-30145 — CVSS 7.5 (high): GeoServer is an open source server that allows users to share and edit geospatial data. Malicious Jiffle scripts can be executed by…
• CVE-2025-21621 — CVSS 6.1 (medium): GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.25.0, a reflected cross-site…
• CVE-2024-23642 — CVSS 4.8 (medium): GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site…
• CVE-2024-23818 — CVSS 4.8 (medium): GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site…