Ping Identity PingFederate

• CVE-2026-20773 High 8.5 Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint 0.4%
• CVE-2025-32736 Medium 4.9 PingFederate Administrative Console CSRF weaknesses 0.2%
• CVE-2025-26862 None 0.0 PingFederate unexpected browser flow initiation in redirectless mode 0.3%
• CVE-2024-25573 Medium 6.9 Stored Cross-Site Scripting in Administrative Console Context 0.4%
• CVE-2025-22854 Medium 6.9 Possible thread exhaustion from processing http responses in PingFederate Google Adapter 0.3%
• CVE-2025-21085 Low 2.1 PingFederate OAuth Grant attribute duplication may use excessive memory 0.3%
• CVE-2024-21832 Low 3.5 PingFederate REST API Data Store Injection 0.2%
• CVE-2024-22377 Medium 5.3 PingFederate Runtime Node Path Traversal 0.4%
• CVE-2024-22477 Low 1.8 PingFederate OIDC Policy Management Editor Cross-Site Scripting 0.2%
• CVE-2023-40148 Medium 6.5 PingFederate Server Side Request Forgery vulnerability 0.5%
• CVE-2023-40545 High 8.8 PingFederate OAuth client_secret_jwt Authentication Bypass 0.9%
• CVE-2023-34085 Low 2.6 User Attribute Disclosure via DynamoDB Data Stores 0.6%
• CVE-2023-39219 High 7.5 Admin Console Denial of Service via Java class enumeration 0.7%
• CVE-2023-37283 High 8.1 Authentication Bypass via HTML Form & Identifier First Adapter 0.9%
• CVE-2022-40724 Medium 6.4 Cross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint. 0.2%
• CVE-2022-23722 Unrated PingFederate Password Reset via Authentication API Mishandling 0.6%
• CVE-2021-42000 Medium 5.3 Ping Identity PingFederate Password Reset and Password Change Mishandling with an authentication policy in parallel reset flows 0.5%
• CVE-2021-40329 Unrated The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management. 1.1%