CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 13:00 UTC)

What this means for you

This week: 5,502 CVEs published, 360 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,502; Show in the list
Critical, last 7 days: 360; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product openidentityplatform:openam. Show all products

28 CVEs, showing 1 to 28

CVE	Severity	Title	Published
CVE-2026-33439	Critical 9.8	Open Access Management (OpenAM) is an access management solution.	Apr 7, 2026
CVE-2026-44793	High 7.0	OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget` Assigned by GitHub_M	Sep 15, 2026
CVE-2026-45052	Critical 9.3	OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints Assigned by GitHub_M	Sep 15, 2026
CVE-2026-53660	High 7.4	OpenAM Insecure SSO Cookie Initialization Assigned by GitHub_M	Sep 15, 2026
CVE-2026-62379	Critical 9.8	OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback Assigned by GitHub_M	Sep 15, 2026
CVE-2026-44202	Medium 5.3	OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice` Assigned by GitHub_M	Sep 15, 2026
CVE-2026-44203	High 8.3	OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl) Assigned by GitHub_M	Sep 15, 2026
CVE-2026-45048	High 8.5	OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC Assigned by GitHub_M	Sep 15, 2026
CVE-2026-45794	High 7.7	OpenAM Unsafe Java Deserialization via SNS Assigned by GitHub_M	Sep 15, 2026
CVE-2026-46498	High 7.6	OpenAM Arbitrary OAuth Token Minting via Push Registration Assigned by GitHub_M	Sep 15, 2026
CVE-2026-46619	Critical 9.3	OpenAM Authentication Bypass via MSISDN LDAP Injection Assigned by GitHub_M	Sep 15, 2026
CVE-2026-46623	High 7.4	OpenAM Account Takeover via Unverified Password Change in OAuth2 Module Assigned by GitHub_M	Sep 15, 2026
CVE-2026-62263	Critical 9.2	OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass Assigned by GitHub_M	Sep 15, 2026
CVE-2026-45051	Critical 9.2	OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage Assigned by GitHub_M	Sep 15, 2026
CVE-2026-62280	Medium 6.1	OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page Assigned by GitHub_M	Sep 15, 2026
CVE-2026-41573	High 7.1	OpenAM LDAP Injection via `_queryId` Parameter Assigned by GitHub_M	Sep 15, 2026
CVE-2026-47424	High 7.5	OpenAM Authenticated RCE via Groovy Sandbox Escape Assigned by GitHub_M	Sep 15, 2026
CVE-2026-47426	High 7.6	OpenAM OAuth Client Impersonation via JWKS Resolver Cache Assigned by GitHub_M	Sep 15, 2026
CVE-2026-48717	Critical 9.1	OpenAM OAuth Authorization Bypass via PKCE Challenge Assigned by GitHub_M	Sep 15, 2026
CVE-2026-105114	Medium 6.1	OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page Assigned by VulnCheck	Oct 3, 2026
CVE-2026-105115	High 8.6	OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface Assigned by VulnCheck	Oct 3, 2026
CVE-2026-105116	Medium 6.1	OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page Assigned by VulnCheck	Oct 3, 2026
CVE-2026-105117	Medium 6.1	OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions Assigned by VulnCheck	Oct 3, 2026
CVE-2026-105118	Medium 4.7	OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession Assigned by VulnCheck	Oct 3, 2026
CVE-2026-105119	Medium 6.8	OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows Assigned by VulnCheck	Oct 3, 2026
CVE-2026-105120	Medium 4.9	OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint Assigned by VulnCheck	Oct 3, 2026
CVE-2026-105121	Medium 4.9	OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping Assigned by VulnCheck	Oct 3, 2026
CVE-2026-105122	Medium 5.4	OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri Assigned by VulnCheck	Oct 3, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.