Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,565All CVEsplus 18,890 rejected
- 360Last 24 hours2,992 in the last 7 days
- 17,093Last 30 days1,578 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 1 | 4 | 0 | 0 | 6 | 53 |
| 2025 | 1 | 1 | 2 | 1 | 1 | 6 | 47 |
| 2024 | 0 | 5 | 4 | 3 | 0 | 12 | 41 |
| 2023 | 0 | 6 | 2 | 3 | 0 | 11 | 29 |
| 2022 | 0 | 8 | 7 | 0 | 0 | 15 | 18 |
| 2021 | 1 | 1 | 1 | 0 | 0 | 3 | 3 |
| Title | ||
|---|---|---|
| CVE-2026-80327 | Open Redirect in PingGateway Fragment FilterPing Identity · PingGateway | Medium5.1 |
| CVE-2026-21391 | Improper Claim Validation in PingAM OIDC ProviderPing Identity · PingAM | Critical9.5 |
| CVE-2026-20773 | Improper Authorization in PingFederate Administrative Expression Evaluation EndpointPing Identity · PingFederate | High8.5 |
| CVE-2025-32736 | PingFederate Administrative Console CSRF weaknessesPing Identity · PingFederate | Medium4.9 |
| CVE-2026-20746 | PingDirectory copying of virtual attributes leads to memory exhaustionPing Identity · PingDirectory | Medium6.3 |
| CVE-2025-20628 | Insufficient granularity of access control for Remote Connector Servers in client modePing Identity · PingIDM | Medium6.9 |
| CVE-2025-27935 | Authentication Bypass in OTP (One-time Passcode) IdP Adapter Integration KitPing Identity · One-Time Passcode Integration Kit for PingFederate | High8.6 |
| CVE-2025-26862 | PingFederate unexpected browser flow initiation in redirectless modePing Identity · PingFederate | None0.0 |
| CVE-2024-25573 | Stored Cross-Site Scripting in Administrative Console ContextPing Identity · PingFederate | Medium6.9 |
| CVE-2025-22854 | Possible thread exhaustion from processing http responses in PingFederate Google AdapterPing Identity · PingFederate | Medium6.9 |
| CVE-2025-21085 | PingFederate OAuth Grant attribute duplication may use excessive memoryPing Identity · PingFederate | Low2.1 |
| CVE-2025-20059 | PingAM Java Policy Agent path traversalPing Identity · PingAM Java Policy Agent | Critical9.2 |
| CVE-2024-23983 | Access rules for PingAccess may be circumvented with URL-encoded charactersPing Identity · PingAccess | Medium5.8 |
| CVE-2024-25566 | Open Redirect in PingAMPing Identity · PingAM | Medium5.1 |
| CVE-2024-23600 | PingIDM Query Filter VulnerabilityPing Identity · PingIDM | Low2.7 |
| CVE-2024-21832 | PingFederate REST API Data Store InjectionPing Identity · PingFederate | Low3.5 |
| CVE-2024-22377 | PingFederate Runtime Node Path TraversalPing Identity · PingFederate | Medium5.3 |
| CVE-2024-22477 | PingFederate OIDC Policy Management Editor Cross-Site ScriptingPing Identity · PingFederate | Low1.8 |
| CVE-2023-40356 | PingOne MFA Integration Kit MFA bypassPing Identity · PingOne MFA Integration Kit for PingFederate | High8.7 |
| CVE-2023-40702 | PingOne MFA Integration Kit MFA bypassPing Identity · PingOne MFA Integration Kit for PingFederate | High7.7 |
| CVE-2024-23316 | PingAccess HTTP Request Desynchronization WeaknessPing Identity · PingAccess | High8.8 |
| CVE-2023-40148 | PingFederate Server Side Request Forgery vulnerabilityPing Identity · PingFederate | Medium6.5 |
| CVE-2023-40545 | PingFederate OAuth client_secret_jwt Authentication BypassPing Identity · PingFederate | High8.8 |
| CVE-2023-36496 | Delegated Admin Virtual Attribute Provider Privilege EscalationPing Identity · PingDirectory | High7.7 |
| CVE-2023-34085 | User Attribute Disclosure via DynamoDB Data StoresPing Identity · PingFederate | Low2.6 |
| CVE-2023-39219 | Admin Console Denial of Service via Java class enumerationPing Identity · PingFederate | High7.5 |
| CVE-2023-37283 | Authentication Bypass via HTML Form & Identifier First AdapterPing Identity · PingFederate | High8.1 |
| CVE-2023-39930 | PingFederate PingID Radius PCV Authentication BypassPing Identity · PingID Radius PCV | High7.5 |
| CVE-2023-39231 | PingFederate PingOne MFA IK Device Pairing Second Factor Authentication BypassPing Identity · PingOne MFA Integration Kit | High7.3 |
| CVE-2022-40725 | PingID Desktop PIN attempt lockout bypass.Ping Identity · PingID Desktop for Windows | High7.3 |
| CVE-2022-40724 | Cross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint.Ping Identity · PingFederate | Medium6.4 |
| CVE-2022-40723 | Configuration-based MFA Bypass in PingID RADIUS PCV.Ping Identity · PingID Radius PCV | Medium6.5 |
| CVE-2022-40722 | Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate.Ping Identity · PingID Adapter for PingFederate | High7.7 |
| CVE-2022-23721 | PingID integration for Windows login duplicate username collision.Ping Identity · unspecified | Low3.8 |
| CVE-2018-25084 | Ping Identity Self-Service Account Manager SSAMController.java cross site scriptingPing Identity · Self-Service Account Manager | Low3.5 |
| CVE-2022-23726 | PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amounts of sensitive…Ping Identity · PingCentral | Medium5.4 |
| CVE-2022-23725 | PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circumstancesPing Identity · PingID Windows Login | High7.7 |
| CVE-2022-23720 | PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties filePing Identity · PingID Windows Login | High7.5 |
| CVE-2022-23719 | PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requestsPing Identity · PingID Windows Login | High7.2 |
| CVE-2022-23718 | PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code executionPing Identity · PingID Windows Login | High7.6 |
| CVE-2022-23717 | PingID Windows Login prior to 2.8 denial of service conditionPing Identity · PingID Windows Login | Medium5.0 |
| CVE-2021-41995 | PingID Mac Login prior to 1.1 vulnerable to pre-computed dictionary attacksPing Identity · PingID Mac Login | High7.7 |
| CVE-2022-23724 | PingID Integration for Windows Login MFA BypassPing Identity · PingID Integration for Windows Login | Medium6.4 |
| CVE-2022-23723 | PingFederate PingOneMFA Integration Kit MFA BypassPing Identity · PingFederate PingOne MFA Integration Kit | High7.7 |
| CVE-2022-23722 | PingFederate Password Reset via Authentication API MishandlingPing Identity · PingFederate | Medium6.5 |
| CVE-2021-42001 | PingID Desktop encryption libraries misconfiguration can lead to sensitive data exposurePing Identity · PingID Desktop | High8.0 |
| CVE-2021-41994 | PingID iOS mobile application prior to 1.19 vulnerable to pre-computed dictionary attacksPing Identity · PingID Mobile Application | Medium6.6 |
| CVE-2021-41993 | PingID Android mobile application prior to 1.19 vulnerable to pre-computed dictionary attacksPing Identity · PingID Mobile Application | Medium6.6 |
| CVE-2021-41992 | PingID Windows Login RSA cryptographic weakness with possible offline MFA bypassPing Identity · PingID Windows Login | High7.7 |
| CVE-2021-42000 | Ping Identity PingFederate Password Reset and Password Change Mishandling with an authentication policy in parallel reset flowsPing Identity · PingFederate | Medium5.3 |