CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 1 h ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 215%
High: 215%
Medium: 754%
Low or not scored: 215%

Matching CVEs: 13; Last two years
Critical: 2; CVSS 9.0 and above
High: 2; CVSS 7.0 to 8.9
Known exploited: 0; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 3 · June 2025

Most CVEs

In each company's software, last two years

Matching CVEs

5.1Med
CVE-2026-80327 (opens in a new tab)
An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3.0 through 2025.11.1. It is fixed in versions 2024.11.2, 2025.11.2, and 2026.3.0 (and later).
Ping Identity· Oct 6, 2026
9.5Crit
CVE-2026-21391 (opens in a new tab)
An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain configurations this could allow an attacker to bypass authentication controls via spoofing leading to privilege escalation or impersonation.
Ping Identity· Sep 14, 2026
8.5High
CVE-2026-20773 (opens in a new tab)
A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions.
Ping Identity· Sep 14, 2026
4.9Med
CVE-2025-32736 (opens in a new tab)
Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions.
Ping Identity· Aug 10, 2026
6.3Med
CVE-2026-20746 (opens in a new tab)
Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when recent login history is enabled and copying virtual attributes that reference ds-privilege-name values.
Ping Identity· Jun 12, 2026
6.9Med
CVE-2025-20628 (opens in a new tab)
An insufficient granularity of access control vulnerability exists in PingIDM (formerly ForgeRock Identity Management) where administrators cannot properly configure access rules for Remote Connector Servers (RCS) running in client mode. This means attackers can spoof a client-mode RCS (if one exists) to intercept and/or modify an identity’s security-relevant properties, such as passwords and account recovery information. This issue is exploitable only when an RCS is configured to run in client mode.
Ping Identity· Apr 7, 2026
8.6High
CVE-2025-27935 (opens in a new tab)
The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state without verifying the OTP, thereby bypassing multi-factor authentication.
Ping Identity· Dec 4, 2025
0.0None
CVE-2025-26862 (opens in a new tab)
Unexpected authentication form rendering in HTML Form Adapter using only non-default redirectless mode in PingFederate allows authentication attempts which may enable brute force login attacks.
Ping Identity· Oct 27, 2025
6.9Med
CVE-2024-25573 (opens in a new tab)
Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing.
Ping Identity· Jun 15, 2025
6.9Med
CVE-2025-22854 (opens in a new tab)
Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal usage conditions.
Ping Identity· Jun 15, 2025
2.1Low
CVE-2025-21085 (opens in a new tab)
PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization.
Ping Identity· Jun 15, 2025
9.2Crit
CVE-2025-20059 (opens in a new tab)
Relative Path Traversal vulnerability in Ping Identity PingAM Java Policy Agent allows Parameter Injection.This issue affects PingAM Java Policy Agent: through 5.10.3, through 2023.11.1, through 2024.9.
Ping Identity· Feb 20, 2025
5.8Med
CVE-2024-23983 (opens in a new tab)
Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.
Ping Identity· Nov 11, 2024

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 1 h ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.