# A CVE ID is a name. The value is knowing who the attacker becomes.

Source: https://startwithidentity.com/blog/identity-cve-catalog-launch/
Last updated: 2026-08-13
License: content by Start with Identity. Cite the source URL.

---

Most CVE pages are written for scanners. They give you a vector string, a CPE that may never get filled in, and a paragraph copied from the vendor. That is useful if you are matching a software bill of materials. It is not useful if you are the person who has to tell a CISO whether this week's SAML bug means every admin is impersonable.

We built the [identity CVE catalog](https://startwithidentity.com/cves/) for that person.

## What you get

Each brief answers three questions, in that order:

1. **What broke.** The actual control that failed, in the product's own terms. Parser differential, PAC validation, `alg:none`, kpasswd skipping `PAC_REQUESTOR_SID`.
2. **Why it matters for identity.** Who the attacker becomes. A Global Admin in every Entra tenant is not the same class of event as a local DoS.
3. **What to do this week.** Patch the build string, rotate the signing key, hunt the rogue admin. Named controls, not "review your posture."

We highlight [CISA KEV](https://startwithidentity.com/cves/?kev=1) because that is the public list of "this is being used." We link [vendor profiles](https://startwithidentity.com/vendors/), [standards](https://startwithidentity.com/standards/), and [glossary](https://startwithidentity.com/glossary/) terms the first time they earn it. We do not dump the NVD description.

## Start with the protocol, not the ID

If you own a stack, start on the protocol page, not the CVE ID:

- [SAML](https://startwithidentity.com/cves/saml/): wrapping and parser differentials, including ruby-saml, GHES, Keycloak, and FortiCloud SSO
- [OAuth / OIDC / JWT](https://startwithidentity.com/cves/oauth-oidc/): skipped signatures, audience mix-ups, skip-list bypasses
- [Kerberos / Active Directory](https://startwithidentity.com/cves/kerberos-ad/): PAC, PKINIT, S4U, KerberLoss, ResetNightmare
- [FIDO2 / WebAuthn](https://startwithidentity.com/cves/fido/): Pass-the-Passkey and credential-type confusion
- [Secrets managers](https://startwithidentity.com/cves/secrets/): VaultFault and Conjur IAM-authenticator bypasses
- [Cloud identity](https://startwithidentity.com/cves/cloud-identity/): Entra Actor tokens, CVSS 10.0, no customer patch

Each protocol page says how that protocol is failing *this year*, then lists every brief in the category. That is the page to drop in a team channel when someone asks "are we exposed to the SAML thing."

## Why a community site is doing this

NIST moved NVD to a triage model in April 2026. It will fully enrich only a fraction of new CVEs. Identity flaws already punched above their weight: [CVE-2025-55241](https://startwithidentity.com/cves/cve-2025-55241/) made every Entra tenant impersonable, [CVE-2025-59718](https://startwithidentity.com/cves/cve-2025-59718/) was exploited three days after disclosure, and the ruby-saml series needed four CVEs before "we patched" was true.

Someone has to keep the identity-shaped list current, with practitioner context, without a vendor sponsorship attached. That is us. It is also you, if you want it.

## How to make this yours

- **Read and cite.** The catalog is free, dated, and vendor-neutral. Link the brief, not a screenshot of NVD.
- **Correct us.** Stale patch status, a missing primary source, a 2026 Keycloak SAML ID we have not written yet. Email [community@startwithidentity.com](mailto:community@startwithidentity.com). Corrections are credited.
- **Volunteer as a CVE Analyst.** Two to three hours a week: triage an identity CVE, write the brief to the [editorial standard](https://startwithidentity.com/community/), keep KEV status honest. Public byline. See the [community roles](https://startwithidentity.com/community/).
- **Subscribe.** When we add a brief for a KEV identity item, it will show up in the [newsletter](https://startwithidentity.com/subscribe/) and in [identity news](https://startwithidentity.com/blog/category/news/).

A CVE ID is a name. The value is knowing whether that name means someone can log in as you. [Start with the catalog](https://startwithidentity.com/cves/).