CVE-2026-3416
Vulnerability in Wso2 API Control Plane
CVSS score
7.5
EPSS probability
%0.4
Risk score
0.0
Published
1 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
GitHub
Unauthenticated SSRF in the Chamilo LMS PENS plugin — CVE-2026-34160 / CVSS 8.6
Makefile Go / Python
Similar Vulnerabilities
10.0
CVE-2026-5430 Actively exploited
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
W
WorkaroundEPSS %1
9.1
CVE-2026-3418
Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
W
Patch status unknownEPSS %1
9.1
CVE-2025-13590
Authenticated arbitrary file upload via a System REST API requiring administrator permission.
W
Patch verifiedEPSS %1
9.4
CVE-2025-15039
Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
W
Patch status unknownEPSS %1
8.6
CVE-2026-4249
Vulnerability in Wso2 API Control Plane
W
Patch status unknownEPSS %1
9.8
CVE-2026-1728
Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover
W
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-3416"