---
title: "OSGeo: known exploited vulnerabilities"
url: https://erroneo.us/security/vendor/osgeo/
description: "Every OSGeo vulnerability in CISA's Known Exploited Vulnerabilities catalog since October 2023 (3), newest first, with due dates and fixes."
type: vendor
section: "Security Digest"
date_modified: 2025-12-11
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# OSGeo: known exploited vulnerabilities

- 2025-12-11 [CVE-2025-58360](https://erroneo.us/security/cve/CVE-2025-58360/index.md) OSGeo GeoServer: OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability (due 2026-01-01; ransomware: Unknown)
- 2024-07-15 [CVE-2024-36401](https://erroneo.us/security/cve/CVE-2024-36401/index.md) OSGeo GeoServer: OSGeo GeoServer GeoTools Eval Injection Vulnerability (due 2024-08-05; ransomware: Unknown)
- 2024-06-26 [CVE-2022-24816](https://erroneo.us/security/cve/CVE-2022-24816/index.md) OSGeo JAI-EXT: OSGeo GeoServer JAI-EXT Code Injection Vulnerability (due 2024-07-17; ransomware: Unknown)

---
Source page: https://erroneo.us/security/vendor/osgeo/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt