Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,589All CVEsplus 18,890 rejected
- 356Last 24 hours2,959 in the last 7 days
- 17,105Last 30 days1,584 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 9 | 14 | 8 | 1 | 0 | 32 | 36 |
| 2025 | 0 | 2 | 0 | 0 | 0 | 2 | 4 |
| 2024 | 0 | 1 | 0 | 0 | 0 | 1 | 2 |
| 2023 | 1 | 0 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-46560 | OpenAM Authentication Bypass via RADIUS SpoofingOpenIdentityPlatform · OpenAM | High7.5 |
| CVE-2026-45049 | OpenAM Session Hijacking via CDSSOOpenIdentityPlatform · OpenAM | High8.3 |
| CVE-2026-105122 | OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uriOpenIdentityPlatform · OpenAM | Medium5.3 |
| CVE-2026-105121 | OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm ScopingOpenIdentityPlatform · OpenAM | Medium6.9 |
| CVE-2026-105120 | OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST EndpointOpenIdentityPlatform · OpenAM | Medium6.9 |
| CVE-2026-105119 | OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid FlowsOpenIdentityPlatform · OpenAM | High7.6 |
| CVE-2026-105118 | OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSessionOpenIdentityPlatform · OpenAM | Low2.3 |
| CVE-2026-105117 | OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service ActionsOpenIdentityPlatform · OpenAM | Medium5.3 |
| CVE-2026-105116 | OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce PageOpenIdentityPlatform · OpenAM | Medium5.1 |
| CVE-2026-105115 | OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC InterfaceOpenIdentityPlatform · OpenAM | High8.8 |
| CVE-2026-105114 | OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error PageOpenIdentityPlatform · OpenAM | Medium5.3 |
| CVE-2026-46495 | OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMIOpenIdentityPlatform · OpenDJ | Critical9.2 |
| CVE-2026-48717 | OpenAM OAuth Authorization Bypass via PKCE ChallengeOpenIdentityPlatform · OpenAM | Critical9.1 |
| CVE-2026-47426 | OpenAM OAuth Client Impersonation via JWKS Resolver CacheOpenIdentityPlatform · OpenAM | High7.6 |
| CVE-2026-47424 | OpenAM Authenticated RCE via Groovy Sandbox EscapeOpenIdentityPlatform · OpenAM | High7.5 |
| CVE-2026-41573 | OpenAM LDAP Injection via `_queryId` ParameterOpenIdentityPlatform · OpenAM | High7.1 |
| CVE-2026-62280 | OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent pageOpenIdentityPlatform · OpenAM | Medium6.1 |
| CVE-2026-45051 | OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator StorageOpenIdentityPlatform · OpenAM | Critical9.2 |
| CVE-2026-62263 | OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypassOpenIdentityPlatform · OpenAM | Critical9.2 |
| CVE-2026-46623 | OpenAM Account Takeover via Unverified Password Change in OAuth2 ModuleOpenIdentityPlatform · OpenAM | High7.4 |
| CVE-2026-46619 | OpenAM Authentication Bypass via MSISDN LDAP InjectionOpenIdentityPlatform · OpenAM | Critical9.3 |
| CVE-2026-46498 | OpenAM Arbitrary OAuth Token Minting via Push RegistrationOpenIdentityPlatform · OpenAM | High7.6 |
| CVE-2026-45794 | OpenAM Unsafe Java Deserialization via SNSOpenIdentityPlatform · OpenAM | High7.7 |
| CVE-2026-45048 | OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPCOpenIdentityPlatform · OpenAM | High8.5 |
| CVE-2026-44203 | OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)OpenIdentityPlatform · OpenAM | High8.3 |
| CVE-2026-44202 | OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`OpenIdentityPlatform · OpenAM | Medium5.3 |
| CVE-2026-62379 | OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallbackOpenIdentityPlatform · OpenAM | Critical9.8 |
| CVE-2026-53660 | OpenAM Insecure SSO Cookie InitializationOpenIdentityPlatform · OpenAM | High7.4 |
| CVE-2026-45052 | OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery EndpointsOpenIdentityPlatform · OpenAM | Critical9.3 |
| CVE-2026-44793 | OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`OpenIdentityPlatform · OpenAM | High7.0 |
| CVE-2026-73644 | OpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user without an ACI proxy grantOpenIdentityPlatform · OpenDJ | Critical9.6 |
| CVE-2026-33439 | Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAMOpenIdentityPlatform · OpenAM | Critical9.3 |
| CVE-2025-64099 | OpenAM allows use of arbitrary OIDC requested claims values in id_token and user_infoOpenIdentityPlatform · OpenAM | High8.1 |
| CVE-2025-27497 | OpenDJ Denial of Service (Dos) using alias loopOpenIdentityPlatform · OpenDJ | High8.7 |
| CVE-2024-41667 | OpenAM FreeMarker template injectionOpenIdentityPlatform · OpenAM | High8.8 |
| CVE-2023-37471 | User impersonation using SAMLv1.x SSO in Open Access ManagementOpenIdentityPlatform · OpenAM | Critical9.1 |