CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 13:10 UTC)

What this means for you

This week: 5,477 CVEs published, 360 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,477; Show in the list
Critical, last 7 days: 360; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product openidentityplatform:openam. Show all products

28 CVEs, showing 1 to 28

CVE	Severity	Title	Published
CVE-2026-105122	Medium 5.4	OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri Assigned by VulnCheck	Oct 3, 2026
CVE-2026-105121	Medium 4.9	OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping Assigned by VulnCheck	Oct 3, 2026
CVE-2026-105120	Medium 4.9	OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint Assigned by VulnCheck	Oct 3, 2026
CVE-2026-105119	Medium 6.8	OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows Assigned by VulnCheck	Oct 3, 2026
CVE-2026-105118	Medium 4.7	OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession Assigned by VulnCheck	Oct 3, 2026
CVE-2026-105117	Medium 6.1	OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions Assigned by VulnCheck	Oct 3, 2026
CVE-2026-105116	Medium 6.1	OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page Assigned by VulnCheck	Oct 3, 2026
CVE-2026-105115	High 8.6	OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface Assigned by VulnCheck	Oct 3, 2026
CVE-2026-105114	Medium 6.1	OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page Assigned by VulnCheck	Oct 3, 2026
CVE-2026-48717	Critical 9.1	OpenAM OAuth Authorization Bypass via PKCE Challenge Assigned by GitHub_M	Sep 15, 2026
CVE-2026-47426	High 7.6	OpenAM OAuth Client Impersonation via JWKS Resolver Cache Assigned by GitHub_M	Sep 15, 2026
CVE-2026-47424	High 7.5	OpenAM Authenticated RCE via Groovy Sandbox Escape Assigned by GitHub_M	Sep 15, 2026
CVE-2026-41573	High 7.1	OpenAM LDAP Injection via `_queryId` Parameter Assigned by GitHub_M	Sep 15, 2026
CVE-2026-62280	Medium 6.1	OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page Assigned by GitHub_M	Sep 15, 2026
CVE-2026-45051	Critical 9.2	OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage Assigned by GitHub_M	Sep 15, 2026
CVE-2026-62263	Critical 9.2	OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass Assigned by GitHub_M	Sep 15, 2026
CVE-2026-46623	High 7.4	OpenAM Account Takeover via Unverified Password Change in OAuth2 Module Assigned by GitHub_M	Sep 15, 2026
CVE-2026-46619	Critical 9.3	OpenAM Authentication Bypass via MSISDN LDAP Injection Assigned by GitHub_M	Sep 15, 2026
CVE-2026-46498	High 7.6	OpenAM Arbitrary OAuth Token Minting via Push Registration Assigned by GitHub_M	Sep 15, 2026
CVE-2026-45794	High 7.7	OpenAM Unsafe Java Deserialization via SNS Assigned by GitHub_M	Sep 15, 2026
CVE-2026-45048	High 8.5	OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC Assigned by GitHub_M	Sep 15, 2026
CVE-2026-44203	High 8.3	OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl) Assigned by GitHub_M	Sep 15, 2026
CVE-2026-44202	Medium 5.3	OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice` Assigned by GitHub_M	Sep 15, 2026
CVE-2026-62379	Critical 9.8	OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback Assigned by GitHub_M	Sep 15, 2026
CVE-2026-53660	High 7.4	OpenAM Insecure SSO Cookie Initialization Assigned by GitHub_M	Sep 15, 2026
CVE-2026-45052	Critical 9.3	OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints Assigned by GitHub_M	Sep 15, 2026
CVE-2026-44793	High 7.0	OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget` Assigned by GitHub_M	Sep 15, 2026
CVE-2026-33439	Critical 9.8	Open Access Management (OpenAM) is an access management solution.	Apr 7, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.