Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,136All CVEsplus 19,141 rejected
- 329Last 24 hours3,295 in the last 7 days
- 16,930Last 30 days1,560 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 12 | 18 | 16 | 4 | 0 | 50 | 54 |
| 2025 | 0 | 2 | 0 | 0 | 0 | 2 | 4 |
| 2024 | 0 | 1 | 0 | 0 | 0 | 1 | 2 |
| 2023 | 1 | 0 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-123553 | OpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated LoginOpenIdentityPlatform · OpenAM | Medium6.9 |
| CVE-2026-123552 | OpenAM before 16.1.4 SSRF and CRL Tampering via Certificate CRL Distribution PointOpenIdentityPlatform · OpenAM | Medium6.3 |
| CVE-2026-123551 | OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocketOpenIdentityPlatform · OpenAM | Critical10.0 |
| CVE-2026-123550 | OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned AssertionsOpenIdentityPlatform · OpenAM | Critical9.3 |
| CVE-2026-123549 | OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute BypassOpenIdentityPlatform · OpenAM | Critical9.3 |
| CVE-2026-123548 | OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 PagesOpenIdentityPlatform · OpenAM | Low2.3 |
| CVE-2026-123547 | OpenAM before 16.1.4 Open Redirect via SAML v2.0 RelayStateOpenIdentityPlatform · OpenAM | Low2.3 |
| CVE-2026-123546 | OpenAM before 16.1.4 Open Redirect and XSS via goto and gotoOnFailOpenIdentityPlatform · OpenAM | Medium5.3 |
| CVE-2026-123545 | OpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device FlowOpenIdentityPlatform · OpenAM | High7.1 |
| CVE-2026-123544 | OpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP ChannelOpenIdentityPlatform · OpenAM | Medium6.1 |
| CVE-2026-123543 | OpenAM before 16.1.4 Unauthenticated DoS via Unbounded Java DeserialisationOpenIdentityPlatform · OpenAM | High8.7 |
| CVE-2026-123542 | OpenAM before 16.1.4 PKCE Bypass in OAuth 2.0 Device Authorization FlowOpenIdentityPlatform · OpenAM | High7.6 |
| CVE-2026-123541 | OpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner MatchingOpenIdentityPlatform · OpenAM | Medium5.3 |
| CVE-2026-123540 | OpenAM before 16.1.4 Incomplete Attribute Encoding in SAML 1.x Form POSTOpenIdentityPlatform · OpenAM | Low2.0 |
| CVE-2026-123539 | OpenAM before 16.1.4 Stored XSS via OAuth 2.0 Consent Page Display NameOpenIdentityPlatform · OpenAM | Medium4.8 |
| CVE-2026-123538 | OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer ImpersonationOpenIdentityPlatform · OpenAM | High7.5 |
| CVE-2026-123537 | OpenAM before 16.1.4 SSRF via UMA Scope Description URLsOpenIdentityPlatform · OpenAM | Medium5.3 |
| CVE-2026-123536 | OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLsOpenIdentityPlatform · OpenAM | Medium5.1 |
| CVE-2026-46560 | OpenAM Authentication Bypass via RADIUS SpoofingOpenIdentityPlatform · OpenAM | High7.5 |
| CVE-2026-45049 | OpenAM Session Hijacking via CDSSOOpenIdentityPlatform · OpenAM | High8.3 |
| CVE-2026-105122 | OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uriOpenIdentityPlatform · OpenAM | Medium5.3 |
| CVE-2026-105121 | OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm ScopingOpenIdentityPlatform · OpenAM | Medium6.9 |
| CVE-2026-105120 | OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST EndpointOpenIdentityPlatform · OpenAM | Medium6.9 |
| CVE-2026-105119 | OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid FlowsOpenIdentityPlatform · OpenAM | High7.6 |
| CVE-2026-105118 | OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSessionOpenIdentityPlatform · OpenAM | Low2.3 |
| CVE-2026-105117 | OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service ActionsOpenIdentityPlatform · OpenAM | Medium5.3 |
| CVE-2026-105116 | OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce PageOpenIdentityPlatform · OpenAM | Medium5.1 |
| CVE-2026-105115 | OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC InterfaceOpenIdentityPlatform · OpenAM | High8.8 |
| CVE-2026-105114 | OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error PageOpenIdentityPlatform · OpenAM | Medium5.3 |
| CVE-2026-46495 | OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMIOpenIdentityPlatform · OpenDJ | Critical9.2 |
| CVE-2026-48717 | OpenAM OAuth Authorization Bypass via PKCE ChallengeOpenIdentityPlatform · OpenAM | Critical9.1 |
| CVE-2026-47426 | OpenAM OAuth Client Impersonation via JWKS Resolver CacheOpenIdentityPlatform · OpenAM | High7.6 |
| CVE-2026-47424 | OpenAM Authenticated RCE via Groovy Sandbox EscapeOpenIdentityPlatform · OpenAM | High7.5 |
| CVE-2026-41573 | OpenAM LDAP Injection via `_queryId` ParameterOpenIdentityPlatform · OpenAM | High7.1 |
| CVE-2026-62280 | OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent pageOpenIdentityPlatform · OpenAM | Medium6.1 |
| CVE-2026-45051 | OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator StorageOpenIdentityPlatform · OpenAM | Critical9.2 |
| CVE-2026-62263 | OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypassOpenIdentityPlatform · OpenAM | Critical9.2 |
| CVE-2026-46623 | OpenAM Account Takeover via Unverified Password Change in OAuth2 ModuleOpenIdentityPlatform · OpenAM | High7.4 |
| CVE-2026-46619 | OpenAM Authentication Bypass via MSISDN LDAP InjectionOpenIdentityPlatform · OpenAM | Critical9.3 |
| CVE-2026-46498 | OpenAM Arbitrary OAuth Token Minting via Push RegistrationOpenIdentityPlatform · OpenAM | High7.6 |
| CVE-2026-45794 | OpenAM Unsafe Java Deserialization via SNSOpenIdentityPlatform · OpenAM | High7.7 |
| CVE-2026-45048 | OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPCOpenIdentityPlatform · OpenAM | High8.5 |
| CVE-2026-44203 | OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)OpenIdentityPlatform · OpenAM | High8.3 |
| CVE-2026-44202 | OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`OpenIdentityPlatform · OpenAM | Medium5.3 |
| CVE-2026-62379 | OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallbackOpenIdentityPlatform · OpenAM | Critical9.8 |
| CVE-2026-53660 | OpenAM Insecure SSO Cookie InitializationOpenIdentityPlatform · OpenAM | High7.4 |
| CVE-2026-45052 | OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery EndpointsOpenIdentityPlatform · OpenAM | Critical9.3 |
| CVE-2026-44793 | OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`OpenIdentityPlatform · OpenAM | High7.0 |
| CVE-2026-73644 | OpenDJ: Authorization bypass in SASL PLAIN allowing a `proxied-auth` holder to impersonate any resolvable non-root user without an ACI proxy grantOpenIdentityPlatform · OpenDJ | Critical9.6 |
| CVE-2026-33439 | Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAMOpenIdentityPlatform · OpenAM | Critical9.3 |