Ping Identity PingFederate vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20222
3. 20234
4. 20245
5. 20254
6. 20262

Newest CVEs

• CVE-2026-20773

  Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint

  Ping Identity · PingFederate

  High8.5
• CVE-2025-32736

  PingFederate Administrative Console CSRF weaknesses

  Ping Identity · PingFederate

  Medium4.9
• CVE-2025-26862

  PingFederate unexpected browser flow initiation in redirectless mode

  Ping Identity · PingFederate

  None0.0
• CVE-2024-25573

  Stored Cross-Site Scripting in Administrative Console Context

  Ping Identity · PingFederate

  Medium6.9
• CVE-2025-22854

  Possible thread exhaustion from processing http responses in PingFederate Google Adapter

  Ping Identity · PingFederate

  Medium6.9
• CVE-2025-21085

  PingFederate OAuth Grant attribute duplication may use excessive memory

  Ping Identity · PingFederate

  Low2.1
• CVE-2024-21832

  PingFederate REST API Data Store Injection

  Ping Identity · PingFederate

  Low3.5
• CVE-2024-22377

  PingFederate Runtime Node Path Traversal

  Ping Identity · PingFederate

  Medium5.3
• CVE-2024-22477

  PingFederate OIDC Policy Management Editor Cross-Site Scripting

  Ping Identity · PingFederate

  Low1.8
• CVE-2023-40148

  PingFederate Server Side Request Forgery vulnerability

  Ping Identity · PingFederate

  Medium6.5