{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:36.800Z","products":["wso2"],"actNowTotal":1,"results":[{"query":"wso2","matched":1,"actNow":1,"events":[{"id":"kev-2026-09-24-wso2-multiple-products","url":"https://securitythreatpulse.com/events/kev-2026-09-24-wso2-multiple-products","title":"Several WSO2 products: attackers can read or change files","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 97 days old, so many systems are likely still unpatched. The severity score is critical (10.0).","tier":"now","rankScore":4,"rankWhy":["Exploitation is confirmed by an authoritative source.","6 products are affected."],"rulesVersion":"v3","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-5430"],"vendor":"WSO2","product":"Multiple Products","affectedProducts":[{"kind":"direct","slug":"wso2/multipleproducts","vendor":"WSO2","product":"Multiple Products","evidence":["kev"],"vendorKey":"wso2","productKey":"multipleproducts"},{"kind":"direct","slug":"wso2/wso2universalgateway","vendor":"Wso2","product":"Wso2 Universal Gateway","evidence":["cpe"],"vendorKey":"wso2","productKey":"wso2universalgateway"},{"kind":"direct","slug":"wso2/wso2trafficmanager","vendor":"Wso2","product":"Wso2 Traffic Manager","evidence":["cpe"],"vendorKey":"wso2","productKey":"wso2trafficmanager"},{"kind":"direct","slug":"wso2/wso2apicontrolplane","vendor":"Wso2","product":"Wso2 API Control Plane","evidence":["cpe"],"vendorKey":"wso2","productKey":"wso2apicontrolplane"},{"kind":"direct","slug":"wso2/wso2apimanager","vendor":"Wso2","product":"Wso2 API Manager","evidence":["cpe"],"vendorKey":"wso2","productKey":"wso2apimanager"},{"kind":"direct","slug":"wso2/wso2carbonapimanagerrestapiutility","vendor":"Wso2","product":"Wso2 Carbon API Manager Rest API Utility","evidence":["cpe"],"vendorKey":"wso2","productKey":"wso2carbonapimanagerrestapiutility"}],"category":{"id":"website","label":"Website or online store","why":"It runs public websites, online stores or the software behind them.","doThis":"Ask whoever runs your website or store to update it."},"summary":"WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.","cvss":10,"epss":0.2239,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-09-24","kevDueDate":"2026-09-27","firstSeenAt":"2026-09-24T00:00:00.000Z","updatedAt":"2026-11-11T08:00:07.905Z","newestEvidenceAt":"2026-10-28T01:36:55.113Z"}]}]}