{
 "title": "Identity Vulnerability Report 2026 dataset",
 "publisher": "Start with Identity (startwithidentity.com)",
 "report": "https://startwithidentity.com/reports/identity-vulnerability-report-2026/",
 "license": "CC BY 4.0. Cite \"Start with Identity, Identity Vulnerability Report 2026\".",
 "snapshot_date": "2026-10-30",
 "method": "One row per CVE brief in the Start with Identity identity CVE catalog. kev and kev_date_added come from the CISA KEV catalog snapshot, not the brief. cwe comes from the brief, else the NVD primary weakness. product_class and cwe_group mappings are defined in scripts/reports/identity-vulnerability-report.mjs. Rows with id_check other than ok are excluded from stats.",
 "product_classes": [
  {
   "slug": "edge-gateway",
   "label": "Edge VPN, gateway and network access",
   "definition": "Internet-facing appliances or proxies that authenticate users or tokens before passing traffic: SSL VPNs, ADCs, WAFs, access proxies, API gateways, NAC."
  },
  {
   "slug": "idp-federation",
   "label": "IdP, SSO and federation server",
   "definition": "Products whose job is to authenticate users and issue assertions or tokens to other apps."
  },
  {
   "slug": "directory-kerberos",
   "label": "Directory, AD and Kerberos",
   "definition": "Active Directory, AD CS, Kerberos KDC, LDAP, and Windows authentication protocols (NTLM, SMB auth)."
  },
  {
   "slug": "pam-remote",
   "label": "PAM, remote access and endpoint management",
   "definition": "Privileged remote access, remote support, RMM, MDM and systems management: tools that hold standing admin access to many endpoints."
  },
  {
   "slug": "mfa-authenticator",
   "label": "MFA, authenticator and passkey",
   "definition": "Authenticator apps, FIDO servers and the platform plumbing around WebAuthn assertions."
  },
  {
   "slug": "library-sdk",
   "label": "Identity library, SDK or plugin",
   "definition": "Code other developers embed: SAML and JWT libraries, OAuth SDKs, CMS SSO plugins."
  },
  {
   "slug": "secrets-manager",
   "label": "Secrets manager",
   "definition": "Machine identity providers that check out secrets to workloads."
  },
  {
   "slug": "iga",
   "label": "Identity governance (IGA)",
   "definition": "Joiner-mover-leaver, access request and provisioning platforms."
  },
  {
   "slug": "protocol-spec",
   "label": "Protocol or specification",
   "definition": "Flaws in the standard itself, not one implementation."
  },
  {
   "slug": "app-builtin-auth",
   "label": "Business or developer app with built-in auth",
   "definition": "Self-hosted applications that run their own login: CI servers, mail, print, collaboration, ITSM, source control, ICS."
  }
 ],
 "cwe_groups": [
  {
   "slug": "missing-auth",
   "label": "Missing, skipped or spoofable authentication",
   "cwes": [
    "CWE-287",
    "CWE-288",
    "CWE-290",
    "CWE-294",
    "CWE-303",
    "CWE-305",
    "CWE-306",
    "CWE-307",
    "CWE-640",
    "CWE-1390",
    "CWE-807",
    "CWE-648",
    "CWE-302",
    "CWE-304"
   ]
  },
  {
   "slug": "signature-crypto",
   "label": "Signature, certificate or crypto validation",
   "cwes": [
    "CWE-347",
    "CWE-295",
    "CWE-345",
    "CWE-325",
    "CWE-327",
    "CWE-328",
    "CWE-324",
    "CWE-547",
    "CWE-641"
   ]
  },
  {
   "slug": "authorization",
   "label": "Authorization and privilege management",
   "cwes": [
    "CWE-266",
    "CWE-269",
    "CWE-284",
    "CWE-285",
    "CWE-639",
    "CWE-862",
    "CWE-863",
    "CWE-1284",
    "CWE-625",
    "CWE-693",
    "CWE-829"
   ]
  },
  {
   "slug": "injection-traversal",
   "label": "Injection, traversal, SSRF and deserialization",
   "cwes": [
    "CWE-22",
    "CWE-23",
    "CWE-66",
    "CWE-77",
    "CWE-78",
    "CWE-79",
    "CWE-94",
    "CWE-427",
    "CWE-502",
    "CWE-918",
    "CWE-1336",
    "CWE-176",
    "CWE-156",
    "CWE-462"
   ]
  },
  {
   "slug": "memory-safety",
   "label": "Memory safety",
   "cwes": [
    "CWE-119",
    "CWE-122",
    "CWE-125",
    "CWE-190",
    "CWE-787",
    "CWE-416"
   ]
  },
  {
   "slug": "race-state",
   "label": "Race condition and session state",
   "cwes": [
    "CWE-362",
    "CWE-367",
    "CWE-384"
   ]
  },
  {
   "slug": "resource-info",
   "label": "Resource exhaustion and information exposure",
   "cwes": [
    "CWE-200",
    "CWE-203",
    "CWE-400",
    "CWE-770",
    "CWE-20"
   ]
  }
 ],
 "stats": {
  "snapshot": {
   "kev_catalog_version": "2026.10.30",
   "kev_date_released": "2026-10-30T17:02:45.3665Z",
   "nvd_totals_queried": "2026-10-30",
   "generated_from": "content/cves/*.md"
  },
  "catalog": {
   "briefs": 115,
   "excluded_id_check": [],
   "analyzed": 115,
   "kev": 35,
   "kev_pct": 30.4,
   "critical": 54,
   "critical_pct": 47,
   "kev_critical": 30,
   "cwe_from_brief": 55,
   "cwe_from_nvd": 60,
   "cwe_unmapped": 0,
   "disclosed_from": "2022-05-10",
   "disclosed_to": "2026-10-15",
   "kev_flag_drift": []
  },
  "base_rate": {
   "kev_entries": 1766,
   "nvd_cves_all": 398648,
   "kev_pct_of_all_cves": 0.44,
   "window": "2022-2026",
   "kev_entries_cve_ids_in_window": 846,
   "nvd_cves_published_in_window": 231740,
   "kev_pct_window": 0.37,
   "identity_catalog_kev_pct": 30.4,
   "multiple_vs_window": 83
  },
  "product_class": [
   {
    "key": "edge-gateway",
    "label": "Edge VPN, gateway and network access",
    "n": 20,
    "kev": 16,
    "kev_pct": 80,
    "share_of_kev_pct": 45.7,
    "critical": 16,
    "median_cvss": 9.8
   },
   {
    "key": "app-builtin-auth",
    "label": "Business or developer app with built-in auth",
    "n": 15,
    "kev": 9,
    "kev_pct": 60,
    "share_of_kev_pct": 25.7,
    "critical": 11,
    "median_cvss": 9.8
   },
   {
    "key": "pam-remote",
    "label": "PAM, remote access and endpoint management",
    "n": 7,
    "kev": 7,
    "kev_pct": 100,
    "share_of_kev_pct": 20,
    "critical": 7,
    "median_cvss": 9.8
   },
   {
    "key": "directory-kerberos",
    "label": "Directory, AD and Kerberos",
    "n": 17,
    "kev": 3,
    "kev_pct": 17.6,
    "share_of_kev_pct": 8.6,
    "critical": 2,
    "median_cvss": 8.8
   },
   {
    "key": "idp-federation",
    "label": "IdP, SSO and federation server",
    "n": 17,
    "kev": 0,
    "kev_pct": 0,
    "share_of_kev_pct": 0,
    "critical": 3,
    "median_cvss": 9.15
   },
   {
    "key": "library-sdk",
    "label": "Identity library, SDK or plugin",
    "n": 14,
    "kev": 0,
    "kev_pct": 0,
    "share_of_kev_pct": 0,
    "critical": 9,
    "median_cvss": 10
   },
   {
    "key": "secrets-manager",
    "label": "Secrets manager",
    "n": 13,
    "kev": 0,
    "kev_pct": 0,
    "share_of_kev_pct": 0,
    "critical": 3,
    "median_cvss": 7.2
   },
   {
    "key": "iga",
    "label": "Identity governance (IGA)",
    "n": 6,
    "kev": 0,
    "kev_pct": 0,
    "share_of_kev_pct": 0,
    "critical": 2,
    "median_cvss": 8.55
   },
   {
    "key": "mfa-authenticator",
    "label": "MFA, authenticator and passkey",
    "n": 3,
    "kev": 0,
    "kev_pct": 0,
    "share_of_kev_pct": 0,
    "critical": 0,
    "median_cvss": null
   },
   {
    "key": "protocol-spec",
    "label": "Protocol or specification",
    "n": 3,
    "kev": 0,
    "kev_pct": 0,
    "share_of_kev_pct": 0,
    "critical": 1,
    "median_cvss": 9
   }
  ],
  "cwe_group": [
   {
    "key": "missing-auth",
    "label": "Missing, skipped or spoofable authentication",
    "n": 35,
    "kev": 16,
    "kev_pct": 45.7,
    "share_of_kev_pct": 45.7,
    "critical": 20,
    "median_cvss": 9.3
   },
   {
    "key": "signature-crypto",
    "label": "Signature, certificate or crypto validation",
    "n": 30,
    "kev": 7,
    "kev_pct": 23.3,
    "share_of_kev_pct": 20,
    "critical": 18,
    "median_cvss": 9.8
   },
   {
    "key": "authorization",
    "label": "Authorization and privilege management",
    "n": 17,
    "kev": 4,
    "kev_pct": 23.5,
    "share_of_kev_pct": 11.4,
    "critical": 2,
    "median_cvss": 7
   },
   {
    "key": "injection-traversal",
    "label": "Injection, traversal, SSRF and deserialization",
    "n": 17,
    "kev": 4,
    "kev_pct": 23.5,
    "share_of_kev_pct": 11.4,
    "critical": 9,
    "median_cvss": 9.15
   },
   {
    "key": "memory-safety",
    "label": "Memory safety",
    "n": 6,
    "kev": 3,
    "kev_pct": 50,
    "share_of_kev_pct": 8.6,
    "critical": 4,
    "median_cvss": 9.5
   },
   {
    "key": "resource-info",
    "label": "Resource exhaustion and information exposure",
    "n": 7,
    "kev": 1,
    "kev_pct": 14.3,
    "share_of_kev_pct": 2.9,
    "critical": 1,
    "median_cvss": null
   },
   {
    "key": "race-state",
    "label": "Race condition and session state",
    "n": 3,
    "kev": 0,
    "kev_pct": 0,
    "share_of_kev_pct": 0,
    "critical": 0,
    "median_cvss": 5.75
   }
  ],
  "protocol": [
   {
    "key": "other",
    "label": "other",
    "n": 32,
    "kev": 23,
    "kev_pct": 71.9,
    "share_of_kev_pct": 65.7,
    "critical": 23,
    "median_cvss": 9.8
   },
   {
    "key": "oauth-oidc",
    "label": "oauth-oidc",
    "n": 20,
    "kev": 5,
    "kev_pct": 25,
    "share_of_kev_pct": 14.3,
    "critical": 9,
    "median_cvss": 9.8
   },
   {
    "key": "saml",
    "label": "saml",
    "n": 24,
    "kev": 4,
    "kev_pct": 16.7,
    "share_of_kev_pct": 11.4,
    "critical": 13,
    "median_cvss": 9.8
   },
   {
    "key": "kerberos-ad",
    "label": "kerberos-ad",
    "n": 13,
    "kev": 2,
    "kev_pct": 15.4,
    "share_of_kev_pct": 5.7,
    "critical": 0,
    "median_cvss": 8.8
   },
   {
    "key": "radius",
    "label": "radius",
    "n": 2,
    "kev": 1,
    "kev_pct": 50,
    "share_of_kev_pct": 2.9,
    "critical": 2,
    "median_cvss": 9.5
   },
   {
    "key": "secrets",
    "label": "secrets",
    "n": 13,
    "kev": 0,
    "kev_pct": 0,
    "share_of_kev_pct": 0,
    "critical": 3,
    "median_cvss": 7.2
   },
   {
    "key": "iga",
    "label": "iga",
    "n": 5,
    "kev": 0,
    "kev_pct": 0,
    "share_of_kev_pct": 0,
    "critical": 2,
    "median_cvss": 8.55
   },
   {
    "key": "fido",
    "label": "fido",
    "n": 2,
    "kev": 0,
    "kev_pct": 0,
    "share_of_kev_pct": 0,
    "critical": 0,
    "median_cvss": null
   },
   {
    "key": "ldap",
    "label": "ldap",
    "n": 2,
    "kev": 0,
    "kev_pct": 0,
    "share_of_kev_pct": 0,
    "critical": 1,
    "median_cvss": 9.8
   },
   {
    "key": "cloud-identity",
    "label": "cloud-identity",
    "n": 1,
    "kev": 0,
    "kev_pct": 0,
    "share_of_kev_pct": 0,
    "critical": 1,
    "median_cvss": 10
   },
   {
    "key": "scim",
    "label": "scim",
    "n": 1,
    "kev": 0,
    "kev_pct": 0,
    "share_of_kev_pct": 0,
    "critical": 0,
    "median_cvss": null
   }
  ],
  "edge": {
   "n": 20,
   "kev": 16,
   "kev_pct": 80,
   "share_of_catalog_pct": 17.4,
   "share_of_kev_pct": 45.7,
   "non_edge_n": 95,
   "non_edge_kev": 19,
   "non_edge_kev_pct": 20,
   "appliance_n": 27,
   "appliance_kev": 23,
   "appliance_kev_pct": 85.2,
   "appliance_share_of_kev_pct": 65.7,
   "appliance_share_of_catalog_pct": 23.5,
   "core_classes": [
    "idp-federation",
    "library-sdk",
    "secrets-manager",
    "iga",
    "mfa-authenticator",
    "protocol-spec"
   ],
   "core_n": 56,
   "core_kev": 0,
   "core_critical": 18,
   "core_share_of_catalog_pct": 48.7,
   "appliance_critical": 23
  },
  "kev_lag": {
   "n": 35,
   "median_days": 3,
   "p25_days": 0.5,
   "p75_days": 18,
   "max_days": 1096,
   "within_0_days": 9,
   "within_7_days": 20,
   "within_7_days_pct": 57.1,
   "within_30_days": 27,
   "within_30_days_pct": 77.1,
   "over_365_days": 2,
   "by_class": {
    "edge-gateway": {
     "n": 16,
     "median_days": 1
    },
    "directory-kerberos": {
     "n": 3,
     "median_days": 100
    },
    "pam-remote": {
     "n": 7,
     "median_days": 3
    },
    "app-builtin-auth": {
     "n": 9,
     "median_days": 11
    }
   },
   "slowest": [
    {
     "id": "CVE-2023-27351",
     "days": 1096
    },
    {
     "id": "CVE-2025-32975",
     "days": 383
    },
    {
     "id": "CVE-2023-29357",
     "days": 211
    },
    {
     "id": "CVE-2026-5430",
     "days": 144
    },
    {
     "id": "CVE-2025-33073",
     "days": 132
    },
    {
     "id": "CVE-2022-26923",
     "days": 100
    },
    {
     "id": "CVE-2026-48558",
     "days": 48
    },
    {
     "id": "CVE-2026-55040",
     "days": 35
    }
   ]
  },
  "saml": {
   "n": 24,
   "cwe_347": 15,
   "cwe_347_pct": 62.5,
   "cwe_347_kev": 1,
   "cwe_347_library": 7,
   "kev": 4,
   "kev_ids": [
    "CVE-2024-21893",
    "CVE-2025-59718",
    "CVE-2026-19490",
    "CVE-2026-88779"
   ],
   "kev_edge": 4
  },
  "token_signature": {
   "n": 6,
   "kev": 4,
   "ids": [
    "CVE-2023-29357",
    "CVE-2025-65945",
    "CVE-2025-9485",
    "CVE-2026-48558",
    "CVE-2026-5430",
    "CVE-2026-55040"
   ]
  },
  "incomplete_fix": {
   "n": 3,
   "kev": 1,
   "ids": [
    "CVE-2024-9487",
    "CVE-2025-54572",
    "CVE-2026-18577"
   ]
  },
  "vendors": [
   {
    "vendor": "Microsoft",
    "n": 21,
    "kev": 5,
    "classes": [
     "directory-kerberos",
     "app-builtin-auth",
     "idp-federation",
     "mfa-authenticator"
    ]
   },
   {
    "vendor": "Red Hat (Keycloak)",
    "n": 13,
    "kev": 0,
    "classes": [
     "idp-federation"
    ]
   },
   {
    "vendor": "HashiCorp",
    "n": 8,
    "kev": 0,
    "classes": [
     "secrets-manager"
    ]
   },
   {
    "vendor": "SAML-Toolkits (ruby-saml)",
    "n": 7,
    "kev": 0,
    "classes": [
     "library-sdk"
    ]
   },
   {
    "vendor": "Ivanti",
    "n": 6,
    "kev": 6,
    "classes": [
     "pam-remote",
     "edge-gateway"
    ]
   },
   {
    "vendor": "SailPoint",
    "n": 6,
    "kev": 0,
    "classes": [
     "iga"
    ]
   },
   {
    "vendor": "CyberArk",
    "n": 5,
    "kev": 0,
    "classes": [
     "secrets-manager"
    ]
   },
   {
    "vendor": "Citrix (Cloud Software Group)",
    "n": 4,
    "kev": 3,
    "classes": [
     "edge-gateway"
    ]
   },
   {
    "vendor": "Fortinet",
    "n": 4,
    "kev": 3,
    "classes": [
     "edge-gateway"
    ]
   },
   {
    "vendor": "GitHub",
    "n": 4,
    "kev": 0,
    "classes": [
     "app-builtin-auth"
    ]
   },
   {
    "vendor": "JetBrains",
    "n": 3,
    "kev": 3,
    "classes": [
     "app-builtin-auth"
    ]
   },
   {
    "vendor": "Okta (incl. Auth0)",
    "n": 3,
    "kev": 0,
    "classes": [
     "mfa-authenticator",
     "library-sdk"
    ]
   },
   {
    "vendor": "BeyondTrust",
    "n": 2,
    "kev": 2,
    "classes": [
     "pam-remote"
    ]
   },
   {
    "vendor": "Check Point",
    "n": 2,
    "kev": 2,
    "classes": [
     "edge-gateway"
    ]
   },
   {
    "vendor": "PaperCut",
    "n": 2,
    "kev": 2,
    "classes": [
     "app-builtin-auth"
    ]
   },
   {
    "vendor": "Cisco",
    "n": 2,
    "kev": 1,
    "classes": [
     "edge-gateway"
    ]
   },
   {
    "vendor": "OpenID Foundation / IETF",
    "n": 2,
    "kev": 0,
    "classes": [
     "protocol-spec"
    ]
   },
   {
    "vendor": "Ping Identity",
    "n": 2,
    "kev": 0,
    "classes": [
     "idp-federation"
    ]
   },
   {
    "vendor": "ConnectWise",
    "n": 1,
    "kev": 1,
    "classes": [
     "pam-remote"
    ]
   },
   {
    "vendor": "F5",
    "n": 1,
    "kev": 1,
    "classes": [
     "edge-gateway"
    ]
   },
   {
    "vendor": "N-able",
    "n": 1,
    "kev": 1,
    "classes": [
     "pam-remote"
    ]
   },
   {
    "vendor": "Quest",
    "n": 1,
    "kev": 1,
    "classes": [
     "pam-remote"
    ]
   },
   {
    "vendor": "SimpleHelp",
    "n": 1,
    "kev": 1,
    "classes": [
     "pam-remote"
    ]
   },
   {
    "vendor": "SmarterTools",
    "n": 1,
    "kev": 1,
    "classes": [
     "app-builtin-auth"
    ]
   },
   {
    "vendor": "Synacor / Zimbra",
    "n": 1,
    "kev": 1,
    "classes": [
     "app-builtin-auth"
    ]
   },
   {
    "vendor": "WSO2",
    "n": 1,
    "kev": 1,
    "classes": [
     "edge-gateway"
    ]
   },
   {
    "vendor": "Drupal",
    "n": 1,
    "kev": 0,
    "classes": [
     "library-sdk"
    ]
   },
   {
    "vendor": "Duende Software",
    "n": 1,
    "kev": 0,
    "classes": [
     "library-sdk"
    ]
   },
   {
    "vendor": "Halo",
    "n": 1,
    "kev": 0,
    "classes": [
     "app-builtin-auth"
    ]
   },
   {
    "vendor": "ICS vendor (see CISA advisory)",
    "n": 1,
    "kev": 0,
    "classes": [
     "app-builtin-auth"
    ]
   },
   {
    "vendor": "miniOrange / WordPress ecosystem",
    "n": 1,
    "kev": 0,
    "classes": [
     "library-sdk"
    ]
   },
   {
    "vendor": "OAuth2-Proxy",
    "n": 1,
    "kev": 0,
    "classes": [
     "edge-gateway"
    ]
   },
   {
    "vendor": "Protocol-wide",
    "n": 1,
    "kev": 0,
    "classes": [
     "protocol-spec"
    ]
   },
   {
    "vendor": "samlify",
    "n": 1,
    "kev": 0,
    "classes": [
     "library-sdk"
    ]
   },
   {
    "vendor": "SAP",
    "n": 1,
    "kev": 0,
    "classes": [
     "library-sdk"
    ]
   },
   {
    "vendor": "StrongKey",
    "n": 1,
    "kev": 0,
    "classes": [
     "mfa-authenticator"
    ]
   },
   {
    "vendor": "Zitadel",
    "n": 1,
    "kev": 0,
    "classes": [
     "idp-federation"
    ]
   }
  ],
  "vendors_repeat": 18,
  "vendors_repeat_kev": [
   {
    "vendor": "Microsoft",
    "n": 21,
    "kev": 5,
    "classes": [
     "directory-kerberos",
     "app-builtin-auth",
     "idp-federation",
     "mfa-authenticator"
    ]
   },
   {
    "vendor": "Ivanti",
    "n": 6,
    "kev": 6,
    "classes": [
     "pam-remote",
     "edge-gateway"
    ]
   },
   {
    "vendor": "Citrix (Cloud Software Group)",
    "n": 4,
    "kev": 3,
    "classes": [
     "edge-gateway"
    ]
   },
   {
    "vendor": "Fortinet",
    "n": 4,
    "kev": 3,
    "classes": [
     "edge-gateway"
    ]
   },
   {
    "vendor": "JetBrains",
    "n": 3,
    "kev": 3,
    "classes": [
     "app-builtin-auth"
    ]
   },
   {
    "vendor": "BeyondTrust",
    "n": 2,
    "kev": 2,
    "classes": [
     "pam-remote"
    ]
   },
   {
    "vendor": "Check Point",
    "n": 2,
    "kev": 2,
    "classes": [
     "edge-gateway"
    ]
   },
   {
    "vendor": "PaperCut",
    "n": 2,
    "kev": 2,
    "classes": [
     "app-builtin-auth"
    ]
   }
  ],
  "by_year": {
   "2022": {
    "n": 1,
    "kev": 1,
    "edge": 0,
    "edge_kev": 0
   },
   "2023": {
    "n": 9,
    "kev": 8,
    "edge": 2,
    "edge_kev": 2
   },
   "2024": {
    "n": 28,
    "kev": 6,
    "edge": 4,
    "edge_kev": 3
   },
   "2025": {
    "n": 50,
    "kev": 4,
    "edge": 4,
    "edge_kev": 2
   },
   "2026": {
    "n": 27,
    "kev": 16,
    "edge": 10,
    "edge_kev": 9
   }
  },
  "kev_auth_cwe_by_year": {
   "2021": {
    "added": 311,
    "with_cwe": 269,
    "auth_cwe": 16,
    "auth_cwe_pct": 5.9
   },
   "2022": {
    "added": 555,
    "with_cwe": 486,
    "auth_cwe": 14,
    "auth_cwe_pct": 2.9
   },
   "2023": {
    "added": 187,
    "with_cwe": 165,
    "auth_cwe": 15,
    "auth_cwe_pct": 9.1
   },
   "2024": {
    "added": 186,
    "with_cwe": 178,
    "auth_cwe": 19,
    "auth_cwe_pct": 10.7
   },
   "2025": {
    "added": 245,
    "with_cwe": 220,
    "auth_cwe": 22,
    "auth_cwe_pct": 10
   },
   "2026": {
    "added": 282,
    "with_cwe": 273,
    "auth_cwe": 43,
    "auth_cwe_pct": 15.8
   }
  },
  "kev_auth_cwe_catalog_coverage": {
   "year": "2026",
   "kev_auth_cwe_additions": 43,
   "in_catalog": 11,
   "not_in_catalog": [
    "CVE-2026-105133 Ahsay AhsayCBS",
    "CVE-2026-42018 JFrog Artifactory",
    "CVE-2026-67277 MikroTik RouterOS",
    "CVE-2026-20079 Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management",
    "CVE-2026-59822 BerriAI LiteLLM",
    "CVE-2026-49869 Kestra Kestra OSS",
    "CVE-2026-82329 JFrog Artifactory",
    "CVE-2026-81578 PaperCut NG/MF",
    "CVE-2023-49105 ownCloud ownCloud",
    "CVE-2026-72529 TrueConf Server",
    "CVE-2026-65400 Apple macOS",
    "CVE-2026-18556 N-able N-central",
    "CVE-2026-16232 Check Point SmartConsole",
    "CVE-2026-46817 Oracle E-Business Suite",
    "CVE-2026-56164 Microsoft SharePoint Server",
    "CVE-2026-20253 Splunk Enterprise",
    "CVE-2026-35273 Oracle  PeopleSoft Enterprise PeopleTools",
    "CVE-2026-50751 Check Point Security Gateway",
    "CVE-2022-0492 Linux Kernel",
    "CVE-2026-20182 Cisco Catalyst SD-WAN",
    "CVE-2026-41940 WebPros cPanel & WHM and WP2 (WordPress Squared)",
    "CVE-2026-39987 Marimo Marimo",
    "CVE-2026-20122 Cisco Catalyst SD-WAN Manger",
    "CVE-2026-33017 Langflow Langflow",
    "CVE-2026-1603 Ivanti  Endpoint Manager (EPM)",
    "CVE-2017-7921 Hikvision Multiple Products",
    "CVE-2026-20127 Cisco Catalyst SD-WAN Controller and Manager",
    "CVE-2026-21514 Microsoft Office",
    "CVE-2026-24423 SmarterTools SmarterMail",
    "CVE-2019-19006 Sangoma FreePBX",
    "CVE-2026-21509 Microsoft Office",
    "CVE-2025-34026 Versa Concerto"
   ],
   "in_catalog_pct": 25.6
  },
  "kev_deadlines": {
   "since": "2026-07-01",
   "additions": 136,
   "due_within_3_days": 107,
   "due_within_3_days_pct": 78.7,
   "catalog_kev_due_within_3_days": 12
  },
  "technique_linked": 31
 },
 "rows": [
  {
   "id": "CVE-2022-26923",
   "vendor": "Microsoft",
   "product": "Active Directory Certificate Services",
   "product_class": "directory-kerberos",
   "protocol": "kerberos-ad",
   "cwe": "CWE-295",
   "cwe_source": "nvd",
   "cwe_group": "signature-crypto",
   "severity": "high",
   "cvss": "8.8",
   "kev": true,
   "kev_date_added": "2022-08-18",
   "disclosed": "2022-05-10",
   "days_disclosure_to_kev": 100,
   "technique": "adcs-certificate-template-abuse",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2022-26923/"
  },
  {
   "id": "CVE-2023-23397",
   "vendor": "Microsoft",
   "product": "Microsoft Outlook for Windows",
   "product_class": "directory-kerberos",
   "protocol": "other",
   "cwe": "CWE-294",
   "cwe_source": "brief",
   "cwe_group": "missing-auth",
   "severity": "critical",
   "cvss": "9.8",
   "kev": true,
   "kev_date_added": "2023-03-14",
   "disclosed": "2023-03-14",
   "days_disclosure_to_kev": 0,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2023-23397/"
  },
  {
   "id": "CVE-2023-27350",
   "vendor": "PaperCut",
   "product": "PaperCut NG/MF",
   "product_class": "app-builtin-auth",
   "protocol": "other",
   "cwe": "CWE-284",
   "cwe_source": "nvd",
   "cwe_group": "authorization",
   "severity": "critical",
   "cvss": "",
   "kev": true,
   "kev_date_added": "2023-04-21",
   "disclosed": "2023-04-20",
   "days_disclosure_to_kev": 1,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2023-27350/"
  },
  {
   "id": "CVE-2023-27351",
   "vendor": "PaperCut",
   "product": "PaperCut NG/MF",
   "product_class": "app-builtin-auth",
   "protocol": "other",
   "cwe": "CWE-287",
   "cwe_source": "brief",
   "cwe_group": "missing-auth",
   "severity": "critical",
   "cvss": "",
   "kev": true,
   "kev_date_added": "2026-04-20",
   "disclosed": "2023-04-20",
   "days_disclosure_to_kev": 1096,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2023-27351/"
  },
  {
   "id": "CVE-2023-29357",
   "vendor": "Microsoft",
   "product": "Microsoft SharePoint Server",
   "product_class": "app-builtin-auth",
   "protocol": "oauth-oidc",
   "cwe": "CWE-347",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "critical",
   "cvss": "9.8",
   "kev": true,
   "kev_date_added": "2024-01-10",
   "disclosed": "2023-06-13",
   "days_disclosure_to_kev": 211,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2023-29357/"
  },
  {
   "id": "CVE-2023-3462",
   "vendor": "HashiCorp",
   "product": "HashiCorp Vault",
   "product_class": "secrets-manager",
   "protocol": "secrets",
   "cwe": "CWE-203",
   "cwe_source": "nvd",
   "cwe_group": "resource-info",
   "severity": "medium",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2023-08-31",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2023-3462/"
  },
  {
   "id": "CVE-2023-35078",
   "vendor": "Ivanti",
   "product": "Ivanti Endpoint Manager Mobile (MobileIron Core)",
   "product_class": "pam-remote",
   "protocol": "other",
   "cwe": "CWE-287",
   "cwe_source": "nvd",
   "cwe_group": "missing-auth",
   "severity": "critical",
   "cvss": "",
   "kev": true,
   "kev_date_added": "2023-07-25",
   "disclosed": "2023-07-24",
   "days_disclosure_to_kev": 1,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2023-35078/"
  },
  {
   "id": "CVE-2023-38035",
   "vendor": "Ivanti",
   "product": "Ivanti Sentry (MobileIron Sentry)",
   "product_class": "edge-gateway",
   "protocol": "other",
   "cwe": "CWE-863",
   "cwe_source": "nvd",
   "cwe_group": "authorization",
   "severity": "critical",
   "cvss": "",
   "kev": true,
   "kev_date_added": "2023-08-22",
   "disclosed": "2023-08-21",
   "days_disclosure_to_kev": 1,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2023-38035/"
  },
  {
   "id": "CVE-2023-42793",
   "vendor": "JetBrains",
   "product": "JetBrains TeamCity On-Premises",
   "product_class": "app-builtin-auth",
   "protocol": "other",
   "cwe": "CWE-306",
   "cwe_source": "nvd",
   "cwe_group": "missing-auth",
   "severity": "critical",
   "cvss": "9.8",
   "kev": true,
   "kev_date_added": "2023-10-04",
   "disclosed": "2023-09-19",
   "days_disclosure_to_kev": 15,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2023-42793/"
  },
  {
   "id": "CVE-2023-46805",
   "vendor": "Ivanti",
   "product": "Ivanti Connect Secure / Policy Secure",
   "product_class": "edge-gateway",
   "protocol": "other",
   "cwe": "CWE-287",
   "cwe_source": "brief",
   "cwe_group": "missing-auth",
   "severity": "critical",
   "cvss": "",
   "kev": true,
   "kev_date_added": "2024-01-10",
   "disclosed": "2024-01-10",
   "days_disclosure_to_kev": 0,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2023-46805/"
  },
  {
   "id": "CVE-2023-4966",
   "vendor": "Citrix (Cloud Software Group)",
   "product": "Citrix NetScaler ADC / Gateway",
   "product_class": "edge-gateway",
   "protocol": "other",
   "cwe": "CWE-119",
   "cwe_source": "brief",
   "cwe_group": "memory-safety",
   "severity": "critical",
   "cvss": "9.4",
   "kev": true,
   "kev_date_added": "2023-10-18",
   "disclosed": "2023-10-10",
   "days_disclosure_to_kev": 8,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2023-4966/"
  },
  {
   "id": "CVE-2023-6544",
   "vendor": "Red Hat (Keycloak)",
   "product": "Keycloak",
   "product_class": "idp-federation",
   "protocol": "other",
   "cwe": "CWE-625",
   "cwe_source": "nvd",
   "cwe_group": "authorization",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-04-16",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2023-6544/"
  },
  {
   "id": "CVE-2023-6717",
   "vendor": "Red Hat (Keycloak)",
   "product": "Keycloak",
   "product_class": "idp-federation",
   "protocol": "saml",
   "cwe": "CWE-79",
   "cwe_source": "brief",
   "cwe_group": "injection-traversal",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-04-16",
   "days_disclosure_to_kev": "",
   "technique": "session-cookie-theft",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2023-6717/"
  },
  {
   "id": "CVE-2023-6787",
   "vendor": "Red Hat (Keycloak)",
   "product": "Keycloak",
   "product_class": "idp-federation",
   "protocol": "oauth-oidc",
   "cwe": "CWE-287",
   "cwe_source": "nvd",
   "cwe_group": "missing-auth",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-04-17",
   "days_disclosure_to_kev": "",
   "technique": "session-cookie-theft",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2023-6787/"
  },
  {
   "id": "CVE-2024-10905",
   "vendor": "SailPoint",
   "product": "SailPoint IdentityIQ",
   "product_class": "iga",
   "protocol": "iga",
   "cwe": "CWE-66",
   "cwe_source": "nvd",
   "cwe_group": "injection-traversal",
   "severity": "critical",
   "cvss": "10.0",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-12-16",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-10905/"
  },
  {
   "id": "CVE-2024-12356",
   "vendor": "BeyondTrust",
   "product": "BeyondTrust Privileged Remote Access / Remote Support",
   "product_class": "pam-remote",
   "protocol": "other",
   "cwe": "CWE-77",
   "cwe_source": "nvd",
   "cwe_group": "injection-traversal",
   "severity": "critical",
   "cvss": "9.8",
   "kev": true,
   "kev_date_added": "2024-12-19",
   "disclosed": "2024-12-16",
   "days_disclosure_to_kev": 3,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-12356/"
  },
  {
   "id": "CVE-2024-1709",
   "vendor": "ConnectWise",
   "product": "ConnectWise ScreenConnect",
   "product_class": "pam-remote",
   "protocol": "other",
   "cwe": "CWE-288",
   "cwe_source": "brief",
   "cwe_group": "missing-auth",
   "severity": "critical",
   "cvss": "10.0",
   "kev": true,
   "kev_date_added": "2024-02-22",
   "disclosed": "2024-02-19",
   "days_disclosure_to_kev": 3,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-1709/"
  },
  {
   "id": "CVE-2024-20355",
   "vendor": "Cisco",
   "product": "Cisco products (SAML 2.0)",
   "product_class": "edge-gateway",
   "protocol": "saml",
   "cwe": "CWE-862",
   "cwe_source": "nvd",
   "cwe_group": "authorization",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-05-22",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-20355/"
  },
  {
   "id": "CVE-2024-20674",
   "vendor": "Microsoft",
   "product": "Windows Kerberos",
   "product_class": "directory-kerberos",
   "protocol": "kerberos-ad",
   "cwe": "CWE-290",
   "cwe_source": "nvd",
   "cwe_group": "missing-auth",
   "severity": "high",
   "cvss": "8.8",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-01-09",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-20674/"
  },
  {
   "id": "CVE-2024-21893",
   "vendor": "Ivanti",
   "product": "Ivanti Connect Secure / Policy Secure",
   "product_class": "edge-gateway",
   "protocol": "saml",
   "cwe": "CWE-918",
   "cwe_source": "brief",
   "cwe_group": "injection-traversal",
   "severity": "critical",
   "cvss": "",
   "kev": true,
   "kev_date_added": "2024-01-31",
   "disclosed": "2024-01-31",
   "days_disclosure_to_kev": 0,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-21893/"
  },
  {
   "id": "CVE-2024-24919",
   "vendor": "Check Point",
   "product": "Check Point Security Gateway",
   "product_class": "edge-gateway",
   "protocol": "other",
   "cwe": "CWE-200",
   "cwe_source": "nvd",
   "cwe_group": "resource-info",
   "severity": "critical",
   "cvss": "",
   "kev": true,
   "kev_date_added": "2024-05-30",
   "disclosed": "2024-05-28",
   "days_disclosure_to_kev": 2,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-24919/"
  },
  {
   "id": "CVE-2024-26248",
   "vendor": "Microsoft",
   "product": "Windows Kerberos",
   "product_class": "directory-kerberos",
   "protocol": "kerberos-ad",
   "cwe": "CWE-303",
   "cwe_source": "nvd",
   "cwe_group": "missing-auth",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-04-09",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-26248/"
  },
  {
   "id": "CVE-2024-27198",
   "vendor": "JetBrains",
   "product": "JetBrains TeamCity On-Premises",
   "product_class": "app-builtin-auth",
   "protocol": "other",
   "cwe": "CWE-288",
   "cwe_source": "nvd",
   "cwe_group": "missing-auth",
   "severity": "critical",
   "cvss": "9.8",
   "kev": true,
   "kev_date_added": "2024-03-07",
   "disclosed": "2024-03-04",
   "days_disclosure_to_kev": 3,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-27198/"
  },
  {
   "id": "CVE-2024-29056",
   "vendor": "Microsoft",
   "product": "Windows Kerberos",
   "product_class": "directory-kerberos",
   "protocol": "kerberos-ad",
   "cwe": "CWE-327",
   "cwe_source": "nvd",
   "cwe_group": "signature-crypto",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-04-09",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-29056/"
  },
  {
   "id": "CVE-2024-3317",
   "vendor": "SailPoint",
   "product": "SailPoint Identity Security Cloud",
   "product_class": "iga",
   "protocol": "iga",
   "cwe": "CWE-1284",
   "cwe_source": "nvd",
   "cwe_group": "authorization",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-04-10",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-3317/"
  },
  {
   "id": "CVE-2024-3318",
   "vendor": "SailPoint",
   "product": "SailPoint Identity Security Cloud",
   "product_class": "iga",
   "protocol": "scim",
   "cwe": "CWE-22",
   "cwe_source": "nvd",
   "cwe_group": "injection-traversal",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-04-10",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-3318/"
  },
  {
   "id": "CVE-2024-3319",
   "vendor": "SailPoint",
   "product": "SailPoint Identity Security Cloud",
   "product_class": "iga",
   "protocol": "iga",
   "cwe": "CWE-94",
   "cwe_source": "nvd",
   "cwe_group": "injection-traversal",
   "severity": "critical",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-04-10",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-3319/"
  },
  {
   "id": "CVE-2024-3596",
   "vendor": "Protocol-wide",
   "product": "RADIUS (RFC 2865)",
   "product_class": "protocol-spec",
   "protocol": "radius",
   "cwe": "CWE-328",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "critical",
   "cvss": "9.0",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-07-09",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "ongoing",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-3596/"
  },
  {
   "id": "CVE-2024-45409",
   "vendor": "SAML-Toolkits (ruby-saml)",
   "product": "ruby-saml",
   "product_class": "library-sdk",
   "protocol": "saml",
   "cwe": "CWE-347",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "critical",
   "cvss": "10.0",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-09-10",
   "days_disclosure_to_kev": "",
   "technique": "federation-trust-abuse-saml-forgery",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-45409/"
  },
  {
   "id": "CVE-2024-49019",
   "vendor": "Microsoft",
   "product": "Active Directory Certificate Services",
   "product_class": "directory-kerberos",
   "protocol": "kerberos-ad",
   "cwe": "CWE-1390",
   "cwe_source": "nvd",
   "cwe_group": "missing-auth",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-11-12",
   "days_disclosure_to_kev": "",
   "technique": "adcs-certificate-template-abuse",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-49019/"
  },
  {
   "id": "CVE-2024-49112",
   "vendor": "Microsoft",
   "product": "Windows LDAP",
   "product_class": "directory-kerberos",
   "protocol": "ldap",
   "cwe": "CWE-190",
   "cwe_source": "nvd",
   "cwe_group": "memory-safety",
   "severity": "critical",
   "cvss": "9.8",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-12-10",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-49112/"
  },
  {
   "id": "CVE-2024-49113",
   "vendor": "Microsoft",
   "product": "Windows LDAP client",
   "product_class": "directory-kerberos",
   "protocol": "ldap",
   "cwe": "CWE-125",
   "cwe_source": "nvd",
   "cwe_group": "memory-safety",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-12-10",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-49113/"
  },
  {
   "id": "CVE-2024-4985",
   "vendor": "GitHub",
   "product": "GitHub Enterprise Server",
   "product_class": "app-builtin-auth",
   "protocol": "saml",
   "cwe": "CWE-347",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-05-20",
   "days_disclosure_to_kev": "",
   "technique": "federation-trust-abuse-saml-forgery",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-4985/"
  },
  {
   "id": "CVE-2024-6202",
   "vendor": "Halo",
   "product": "HaloITSM",
   "product_class": "app-builtin-auth",
   "protocol": "saml",
   "cwe": "CWE-347",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "critical",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-06-20",
   "days_disclosure_to_kev": "",
   "technique": "federation-trust-abuse-saml-forgery",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-6202/"
  },
  {
   "id": "CVE-2024-6800",
   "vendor": "GitHub",
   "product": "GitHub Enterprise Server",
   "product_class": "app-builtin-auth",
   "protocol": "saml",
   "cwe": "CWE-347",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-08-20",
   "days_disclosure_to_kev": "",
   "technique": "federation-trust-abuse-saml-forgery",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-6800/"
  },
  {
   "id": "CVE-2024-7061",
   "vendor": "Okta (incl. Auth0)",
   "product": "Okta Verify for Windows",
   "product_class": "mfa-authenticator",
   "protocol": "other",
   "cwe": "CWE-427",
   "cwe_source": "nvd",
   "cwe_group": "injection-traversal",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-07-23",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-7061/"
  },
  {
   "id": "CVE-2024-8698",
   "vendor": "Red Hat (Keycloak)",
   "product": "Keycloak",
   "product_class": "idp-federation",
   "protocol": "saml",
   "cwe": "CWE-347",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-09-19",
   "days_disclosure_to_kev": "",
   "technique": "federation-trust-abuse-saml-forgery",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-8698/"
  },
  {
   "id": "CVE-2024-9487",
   "vendor": "GitHub",
   "product": "GitHub Enterprise Server",
   "product_class": "app-builtin-auth",
   "protocol": "saml",
   "cwe": "CWE-347",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2024-10-10",
   "days_disclosure_to_kev": "",
   "technique": "federation-trust-abuse-saml-forgery",
   "status": "patched",
   "incomplete_fix": true,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2024-9487/"
  },
  {
   "id": "CVE-2025-0604",
   "vendor": "Red Hat (Keycloak)",
   "product": "Keycloak",
   "product_class": "idp-federation",
   "protocol": "other",
   "cwe": "CWE-287",
   "cwe_source": "nvd",
   "cwe_group": "missing-auth",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-01-22",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-0604/"
  },
  {
   "id": "CVE-2025-10280",
   "vendor": "SailPoint",
   "product": "SailPoint IdentityIQ",
   "product_class": "iga",
   "protocol": "iga",
   "cwe": "CWE-79",
   "cwe_source": "brief",
   "cwe_group": "injection-traversal",
   "severity": "high",
   "cvss": "7.1",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-11-05",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-10280/"
  },
  {
   "id": "CVE-2025-11419",
   "vendor": "Red Hat (Keycloak)",
   "product": "Keycloak",
   "product_class": "idp-federation",
   "protocol": "other",
   "cwe": "CWE-770",
   "cwe_source": "nvd",
   "cwe_group": "resource-info",
   "severity": "medium",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-10-08",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-11419/"
  },
  {
   "id": "CVE-2025-12466",
   "vendor": "Drupal",
   "product": "Drupal Simple OAuth / OIDC",
   "product_class": "library-sdk",
   "protocol": "oauth-oidc",
   "cwe": "CWE-288",
   "cwe_source": "nvd",
   "cwe_group": "missing-auth",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-10-15",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-12466/"
  },
  {
   "id": "CVE-2025-13881",
   "vendor": "Red Hat (Keycloak)",
   "product": "Keycloak",
   "product_class": "idp-federation",
   "protocol": "other",
   "cwe": "CWE-266",
   "cwe_source": "brief",
   "cwe_group": "authorization",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-11-20",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-13881/"
  },
  {
   "id": "CVE-2025-14778",
   "vendor": "Red Hat (Keycloak)",
   "product": "Keycloak",
   "product_class": "idp-federation",
   "protocol": "oauth-oidc",
   "cwe": "CWE-266",
   "cwe_source": "brief",
   "cwe_group": "authorization",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-12-03",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-14778/"
  },
  {
   "id": "CVE-2025-20059",
   "vendor": "Ping Identity",
   "product": "PingAM Java Policy Agent",
   "product_class": "idp-federation",
   "protocol": "other",
   "cwe": "CWE-23",
   "cwe_source": "nvd",
   "cwe_group": "injection-traversal",
   "severity": "critical",
   "cvss": "9.2",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-02-12",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-20059/"
  },
  {
   "id": "CVE-2025-21085",
   "vendor": "Ping Identity",
   "product": "PingFederate",
   "product_class": "idp-federation",
   "protocol": "oauth-oidc",
   "cwe": "CWE-462",
   "cwe_source": "nvd",
   "cwe_group": "injection-traversal",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-03-01",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-21085/"
  },
  {
   "id": "CVE-2025-21242",
   "vendor": "Microsoft",
   "product": "Windows Kerberos",
   "product_class": "directory-kerberos",
   "protocol": "kerberos-ad",
   "cwe": "CWE-200",
   "cwe_source": "nvd",
   "cwe_group": "resource-info",
   "severity": "medium",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-01-14",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-21242/"
  },
  {
   "id": "CVE-2025-23369",
   "vendor": "GitHub",
   "product": "GitHub Enterprise Server",
   "product_class": "app-builtin-auth",
   "protocol": "saml",
   "cwe": "CWE-347",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-01-21",
   "days_disclosure_to_kev": "",
   "technique": "federation-trust-abuse-saml-forgery",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-23369/"
  },
  {
   "id": "CVE-2025-25291",
   "vendor": "SAML-Toolkits (ruby-saml)",
   "product": "ruby-saml",
   "product_class": "library-sdk",
   "protocol": "saml",
   "cwe": "CWE-347",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "critical",
   "cvss": "10.0",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-03-12",
   "days_disclosure_to_kev": "",
   "technique": "federation-trust-abuse-saml-forgery",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-25291/"
  },
  {
   "id": "CVE-2025-25292",
   "vendor": "SAML-Toolkits (ruby-saml)",
   "product": "ruby-saml",
   "product_class": "library-sdk",
   "protocol": "saml",
   "cwe": "CWE-347",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "critical",
   "cvss": "10.0",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-03-12",
   "days_disclosure_to_kev": "",
   "technique": "federation-trust-abuse-saml-forgery",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-25292/"
  },
  {
   "id": "CVE-2025-25293",
   "vendor": "SAML-Toolkits (ruby-saml)",
   "product": "ruby-saml",
   "product_class": "library-sdk",
   "protocol": "saml",
   "cwe": "CWE-400",
   "cwe_source": "brief",
   "cwe_group": "resource-info",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-03-12",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-25293/"
  },
  {
   "id": "CVE-2025-26620",
   "vendor": "Duende Software",
   "product": "Duende .NET OAuth token management",
   "product_class": "library-sdk",
   "protocol": "oauth-oidc",
   "cwe": "CWE-362",
   "cwe_source": "brief",
   "cwe_group": "race-state",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-02-18",
   "days_disclosure_to_kev": "",
   "technique": "cross-tenant-token-confusion",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-26620/"
  },
  {
   "id": "CVE-2025-26647",
   "vendor": "Microsoft",
   "product": "Windows Kerberos KDC",
   "product_class": "directory-kerberos",
   "protocol": "kerberos-ad",
   "cwe": "CWE-20",
   "cwe_source": "brief",
   "cwe_group": "resource-info",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-04-08",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-26647/"
  },
  {
   "id": "CVE-2025-26788",
   "vendor": "StrongKey",
   "product": "StrongKey FIDO Server",
   "product_class": "mfa-authenticator",
   "protocol": "fido",
   "cwe": "CWE-639",
   "cwe_source": "nvd",
   "cwe_group": "authorization",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-02-18",
   "days_disclosure_to_kev": "",
   "technique": "token-replay-unbound-endpoint",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-26788/"
  },
  {
   "id": "CVE-2025-27370",
   "vendor": "OpenID Foundation / IETF",
   "product": "OpenID Connect specification",
   "product_class": "protocol-spec",
   "protocol": "oauth-oidc",
   "cwe": "CWE-305",
   "cwe_source": "nvd",
   "cwe_group": "missing-auth",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-03-01",
   "days_disclosure_to_kev": "",
   "technique": "token-replay-unbound-endpoint",
   "status": "spec-fix",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-27370/"
  },
  {
   "id": "CVE-2025-27371",
   "vendor": "OpenID Foundation / IETF",
   "product": "OAuth 2.0 specification (JWT profile)",
   "product_class": "protocol-spec",
   "protocol": "oauth-oidc",
   "cwe": "CWE-305",
   "cwe_source": "nvd",
   "cwe_group": "missing-auth",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-03-01",
   "days_disclosure_to_kev": "",
   "technique": "token-replay-unbound-endpoint",
   "status": "spec-fix",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-27371/"
  },
  {
   "id": "CVE-2025-31123",
   "vendor": "Zitadel",
   "product": "Zitadel",
   "product_class": "idp-federation",
   "protocol": "oauth-oidc",
   "cwe": "CWE-324",
   "cwe_source": "nvd",
   "cwe_group": "signature-crypto",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-03-27",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-31123/"
  },
  {
   "id": "CVE-2025-32975",
   "vendor": "Quest",
   "product": "Quest KACE Systems Management Appliance",
   "product_class": "pam-remote",
   "protocol": "other",
   "cwe": "CWE-287",
   "cwe_source": "brief",
   "cwe_group": "missing-auth",
   "severity": "critical",
   "cvss": "",
   "kev": true,
   "kev_date_added": "2026-04-20",
   "disclosed": "2025-04-02",
   "days_disclosure_to_kev": 383,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-32975/"
  },
  {
   "id": "CVE-2025-33073",
   "vendor": "Microsoft",
   "product": "Windows SMB / Kerberos",
   "product_class": "directory-kerberos",
   "protocol": "kerberos-ad",
   "cwe": "CWE-284",
   "cwe_source": "nvd",
   "cwe_group": "authorization",
   "severity": "high",
   "cvss": "",
   "kev": true,
   "kev_date_added": "2025-10-20",
   "disclosed": "2025-06-10",
   "days_disclosure_to_kev": 132,
   "technique": "kerberos-delegation-abuse",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-33073/"
  },
  {
   "id": "CVE-2025-47949",
   "vendor": "samlify",
   "product": "samlify",
   "product_class": "library-sdk",
   "protocol": "saml",
   "cwe": "CWE-347",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "critical",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-05-20",
   "days_disclosure_to_kev": "",
   "technique": "federation-trust-abuse-saml-forgery",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-47949/"
  },
  {
   "id": "CVE-2025-49151",
   "vendor": "ICS vendor (see CISA advisory)",
   "product": "ICS product (CISA ICSA-25-175-07)",
   "product_class": "app-builtin-auth",
   "protocol": "oauth-oidc",
   "cwe": "CWE-547",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "critical",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-06-24",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-49151/"
  },
  {
   "id": "CVE-2025-49827",
   "vendor": "CyberArk",
   "product": "CyberArk Conjur / Secrets Manager",
   "product_class": "secrets-manager",
   "protocol": "secrets",
   "cwe": "CWE-807",
   "cwe_source": "brief",
   "cwe_group": "missing-auth",
   "severity": "critical",
   "cvss": "9.1",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-07-15",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-49827/"
  },
  {
   "id": "CVE-2025-49828",
   "vendor": "CyberArk",
   "product": "CyberArk Conjur / Secrets Manager",
   "product_class": "secrets-manager",
   "protocol": "secrets",
   "cwe": "CWE-1336",
   "cwe_source": "nvd",
   "cwe_group": "injection-traversal",
   "severity": "high",
   "cvss": "8.6",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-07-15",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-49828/"
  },
  {
   "id": "CVE-2025-49829",
   "vendor": "CyberArk",
   "product": "CyberArk Conjur / Secrets Manager",
   "product_class": "secrets-manager",
   "protocol": "secrets",
   "cwe": "CWE-862",
   "cwe_source": "nvd",
   "cwe_group": "authorization",
   "severity": "medium",
   "cvss": "6.0",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-07-15",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-49829/"
  },
  {
   "id": "CVE-2025-49830",
   "vendor": "CyberArk",
   "product": "CyberArk Conjur / Secrets Manager",
   "product_class": "secrets-manager",
   "protocol": "secrets",
   "cwe": "CWE-22",
   "cwe_source": "nvd",
   "cwe_group": "injection-traversal",
   "severity": "high",
   "cvss": "7.1",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-07-15",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-49830/"
  },
  {
   "id": "CVE-2025-49831",
   "vendor": "CyberArk",
   "product": "CyberArk Conjur / Secrets Manager",
   "product_class": "secrets-manager",
   "protocol": "secrets",
   "cwe": "CWE-287",
   "cwe_source": "nvd",
   "cwe_group": "missing-auth",
   "severity": "critical",
   "cvss": "9.1",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-07-15",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-49831/"
  },
  {
   "id": "CVE-2025-54572",
   "vendor": "SAML-Toolkits (ruby-saml)",
   "product": "ruby-saml",
   "product_class": "library-sdk",
   "protocol": "saml",
   "cwe": "CWE-347",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "critical",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-07-30",
   "days_disclosure_to_kev": "",
   "technique": "federation-trust-abuse-saml-forgery",
   "status": "patched",
   "incomplete_fix": true,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-54572/"
  },
  {
   "id": "CVE-2025-54576",
   "vendor": "OAuth2-Proxy",
   "product": "OAuth2-Proxy",
   "product_class": "edge-gateway",
   "protocol": "oauth-oidc",
   "cwe": "CWE-290",
   "cwe_source": "nvd",
   "cwe_group": "missing-auth",
   "severity": "critical",
   "cvss": "9.1",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-07-28",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-54576/"
  },
  {
   "id": "CVE-2025-55241",
   "vendor": "Microsoft",
   "product": "Microsoft Entra ID",
   "product_class": "idp-federation",
   "protocol": "cloud-identity",
   "cwe": "CWE-287",
   "cwe_source": "brief",
   "cwe_group": "missing-auth",
   "severity": "critical",
   "cvss": "10.0",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-09-04",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "mitigated-server-side",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-55241/"
  },
  {
   "id": "CVE-2025-58726",
   "vendor": "Microsoft",
   "product": "Windows SMB Server",
   "product_class": "directory-kerberos",
   "protocol": "kerberos-ad",
   "cwe": "CWE-284",
   "cwe_source": "nvd",
   "cwe_group": "authorization",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-10-14",
   "days_disclosure_to_kev": "",
   "technique": "kerberos-delegation-abuse",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-58726/"
  },
  {
   "id": "CVE-2025-59280",
   "vendor": "Microsoft",
   "product": "Windows SMB Client",
   "product_class": "directory-kerberos",
   "protocol": "other",
   "cwe": "CWE-287",
   "cwe_source": "brief",
   "cwe_group": "missing-auth",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-10-14",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-59280/"
  },
  {
   "id": "CVE-2025-59718",
   "vendor": "Fortinet",
   "product": "Fortinet FortiOS / FortiProxy / FortiSwitchManager",
   "product_class": "edge-gateway",
   "protocol": "saml",
   "cwe": "CWE-347",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "critical",
   "cvss": "9.8",
   "kev": true,
   "kev_date_added": "2025-12-16",
   "disclosed": "2025-12-09",
   "days_disclosure_to_kev": 7,
   "technique": "federation-trust-abuse-saml-forgery",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-59718/"
  },
  {
   "id": "CVE-2025-59719",
   "vendor": "Fortinet",
   "product": "Fortinet FortiWeb",
   "product_class": "edge-gateway",
   "protocol": "saml",
   "cwe": "CWE-347",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "critical",
   "cvss": "9.8",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-12-09",
   "days_disclosure_to_kev": "",
   "technique": "federation-trust-abuse-saml-forgery",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-59719/"
  },
  {
   "id": "CVE-2025-5999",
   "vendor": "HashiCorp",
   "product": "HashiCorp Vault",
   "product_class": "secrets-manager",
   "protocol": "secrets",
   "cwe": "CWE-266",
   "cwe_source": "nvd",
   "cwe_group": "authorization",
   "severity": "high",
   "cvss": "7.2",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-08-06",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-5999/"
  },
  {
   "id": "CVE-2025-6000",
   "vendor": "HashiCorp",
   "product": "HashiCorp Vault",
   "product_class": "secrets-manager",
   "protocol": "secrets",
   "cwe": "CWE-94",
   "cwe_source": "nvd",
   "cwe_group": "injection-traversal",
   "severity": "critical",
   "cvss": "9.1",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-08-06",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-6000/"
  },
  {
   "id": "CVE-2025-6004",
   "vendor": "HashiCorp",
   "product": "HashiCorp Vault",
   "product_class": "secrets-manager",
   "protocol": "secrets",
   "cwe": "CWE-307",
   "cwe_source": "nvd",
   "cwe_group": "missing-auth",
   "severity": "medium",
   "cvss": "5.3",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-08-06",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-6004/"
  },
  {
   "id": "CVE-2025-6011",
   "vendor": "HashiCorp",
   "product": "HashiCorp Vault",
   "product_class": "secrets-manager",
   "protocol": "secrets",
   "cwe": "CWE-203",
   "cwe_source": "nvd",
   "cwe_group": "resource-info",
   "severity": "medium",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-08-06",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-6011/"
  },
  {
   "id": "CVE-2025-6013",
   "vendor": "HashiCorp",
   "product": "HashiCorp Vault",
   "product_class": "secrets-manager",
   "protocol": "secrets",
   "cwe": "CWE-156",
   "cwe_source": "nvd",
   "cwe_group": "injection-traversal",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-08-06",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-6013/"
  },
  {
   "id": "CVE-2025-6015",
   "vendor": "HashiCorp",
   "product": "HashiCorp Vault",
   "product_class": "secrets-manager",
   "protocol": "secrets",
   "cwe": "CWE-307",
   "cwe_source": "nvd",
   "cwe_group": "missing-auth",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-08-06",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-6015/"
  },
  {
   "id": "CVE-2025-6037",
   "vendor": "HashiCorp",
   "product": "HashiCorp Vault",
   "product_class": "secrets-manager",
   "protocol": "secrets",
   "cwe": "CWE-295",
   "cwe_source": "nvd",
   "cwe_group": "signature-crypto",
   "severity": "medium",
   "cvss": "6.8",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-08-06",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-6037/"
  },
  {
   "id": "CVE-2025-60704",
   "vendor": "Microsoft",
   "product": "Windows Kerberos KDC (S4U)",
   "product_class": "directory-kerberos",
   "protocol": "kerberos-ad",
   "cwe": "CWE-325",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "high",
   "cvss": "7.5",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-11-11",
   "days_disclosure_to_kev": "",
   "technique": "kerberos-delegation-abuse",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-60704/"
  },
  {
   "id": "CVE-2025-64446",
   "vendor": "Fortinet",
   "product": "Fortinet FortiWeb",
   "product_class": "edge-gateway",
   "protocol": "other",
   "cwe": "CWE-288",
   "cwe_source": "brief",
   "cwe_group": "missing-auth",
   "severity": "critical",
   "cvss": "9.8",
   "kev": true,
   "kev_date_added": "2025-11-14",
   "disclosed": "2025-11-14",
   "days_disclosure_to_kev": 0,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-64446/"
  },
  {
   "id": "CVE-2025-65945",
   "vendor": "Okta (incl. Auth0)",
   "product": "auth0/node-jws",
   "product_class": "library-sdk",
   "protocol": "oauth-oidc",
   "cwe": "CWE-347",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "medium",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-12-04",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-65945/"
  },
  {
   "id": "CVE-2025-66376",
   "vendor": "Synacor / Zimbra",
   "product": "Zimbra Collaboration Suite",
   "product_class": "app-builtin-auth",
   "protocol": "other",
   "cwe": "CWE-79",
   "cwe_source": "nvd",
   "cwe_group": "injection-traversal",
   "severity": "critical",
   "cvss": "",
   "kev": true,
   "kev_date_added": "2026-03-18",
   "disclosed": "2026-03-15",
   "days_disclosure_to_kev": 3,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-66376/"
  },
  {
   "id": "CVE-2025-66567",
   "vendor": "SAML-Toolkits (ruby-saml)",
   "product": "ruby-saml",
   "product_class": "library-sdk",
   "protocol": "saml",
   "cwe": "CWE-347",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "critical",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-12-08",
   "days_disclosure_to_kev": "",
   "technique": "federation-trust-abuse-saml-forgery",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-66567/"
  },
  {
   "id": "CVE-2025-66568",
   "vendor": "SAML-Toolkits (ruby-saml)",
   "product": "ruby-saml",
   "product_class": "library-sdk",
   "protocol": "saml",
   "cwe": "CWE-347",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "critical",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-12-08",
   "days_disclosure_to_kev": "",
   "technique": "federation-trust-abuse-saml-forgery",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-66568/"
  },
  {
   "id": "CVE-2025-67505",
   "vendor": "Okta (incl. Auth0)",
   "product": "Okta Java SDK",
   "product_class": "library-sdk",
   "protocol": "other",
   "cwe": "CWE-362",
   "cwe_source": "brief",
   "cwe_group": "race-state",
   "severity": "high",
   "cvss": "8.4",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-12-11",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-67505/"
  },
  {
   "id": "CVE-2025-7365",
   "vendor": "Red Hat (Keycloak)",
   "product": "Keycloak",
   "product_class": "idp-federation",
   "protocol": "oauth-oidc",
   "cwe": "CWE-367",
   "cwe_source": "brief",
   "cwe_group": "race-state",
   "severity": "low",
   "cvss": "3.1",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-07-08",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-7365/"
  },
  {
   "id": "CVE-2025-9485",
   "vendor": "miniOrange / WordPress ecosystem",
   "product": "OAuth SSO WordPress plugin",
   "product_class": "library-sdk",
   "protocol": "oauth-oidc",
   "cwe": "CWE-347",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "critical",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2025-08-26",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2025-9485/"
  },
  {
   "id": "CVE-2026-102764",
   "vendor": "BeyondTrust",
   "product": "BeyondTrust Remote Support",
   "product_class": "pam-remote",
   "protocol": "other",
   "cwe": "CWE-290",
   "cwe_source": "nvd",
   "cwe_group": "missing-auth",
   "severity": "critical",
   "cvss": "9.3",
   "kev": true,
   "kev_date_added": "2026-10-16",
   "disclosed": "2026-10-15",
   "days_disclosure_to_kev": 1,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-102764/"
  },
  {
   "id": "CVE-2026-104935",
   "vendor": "Ivanti",
   "product": "Ivanti Connect Secure",
   "product_class": "edge-gateway",
   "protocol": "other",
   "cwe": "CWE-290",
   "cwe_source": "brief",
   "cwe_group": "missing-auth",
   "severity": "high",
   "cvss": "8.6",
   "kev": true,
   "kev_date_added": "2026-10-13",
   "disclosed": "2026-10-13",
   "days_disclosure_to_kev": 0,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-104935/"
  },
  {
   "id": "CVE-2026-107406",
   "vendor": "Citrix (Cloud Software Group)",
   "product": "NetScaler ADC and NetScaler Gateway",
   "product_class": "edge-gateway",
   "protocol": "saml",
   "cwe": "CWE-119",
   "cwe_source": "brief",
   "cwe_group": "memory-safety",
   "severity": "critical",
   "cvss": "9.5",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2026-10-08",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-107406/"
  },
  {
   "id": "CVE-2026-111357",
   "vendor": "Ivanti",
   "product": "Ivanti Connect Secure",
   "product_class": "edge-gateway",
   "protocol": "other",
   "cwe": "CWE-829",
   "cwe_source": "brief",
   "cwe_group": "authorization",
   "severity": "high",
   "cvss": "7.0",
   "kev": true,
   "kev_date_added": "2026-10-30",
   "disclosed": "2026-10-15",
   "days_disclosure_to_kev": 15,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-111357/"
  },
  {
   "id": "CVE-2026-18207",
   "vendor": "Red Hat (Keycloak)",
   "product": "Keycloak",
   "product_class": "idp-federation",
   "protocol": "oauth-oidc",
   "cwe": "CWE-285",
   "cwe_source": "nvd",
   "cwe_group": "authorization",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2026-03-18",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-18207/"
  },
  {
   "id": "CVE-2026-18577",
   "vendor": "N-able",
   "product": "N-able N-central",
   "product_class": "pam-remote",
   "protocol": "other",
   "cwe": "CWE-288",
   "cwe_source": "nvd",
   "cwe_group": "missing-auth",
   "severity": "critical",
   "cvss": "",
   "kev": true,
   "kev_date_added": "2026-08-03",
   "disclosed": "2026-08-03",
   "days_disclosure_to_kev": 0,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": true,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-18577/"
  },
  {
   "id": "CVE-2026-18963",
   "vendor": "Red Hat (Keycloak)",
   "product": "Keycloak",
   "product_class": "idp-federation",
   "protocol": "other",
   "cwe": "CWE-640",
   "cwe_source": "brief",
   "cwe_group": "missing-auth",
   "severity": "critical",
   "cvss": "9.1",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2026-08-19",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-18963/"
  },
  {
   "id": "CVE-2026-18967",
   "vendor": "Red Hat (Keycloak)",
   "product": "Keycloak",
   "product_class": "idp-federation",
   "protocol": "saml",
   "cwe": "CWE-294",
   "cwe_source": "nvd",
   "cwe_group": "missing-auth",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2026-08-05",
   "days_disclosure_to_kev": "",
   "technique": "token-replay-unbound-endpoint",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-18967/"
  },
  {
   "id": "CVE-2026-19490",
   "vendor": "Citrix (Cloud Software Group)",
   "product": "NetScaler ADC and NetScaler Gateway",
   "product_class": "edge-gateway",
   "protocol": "saml",
   "cwe": "CWE-288",
   "cwe_source": "brief",
   "cwe_group": "missing-auth",
   "severity": "critical",
   "cvss": "9.3",
   "kev": true,
   "kev_date_added": "2026-09-09",
   "disclosed": "2026-08-19",
   "days_disclosure_to_kev": 21,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-19490/"
  },
  {
   "id": "CVE-2026-20849",
   "vendor": "Microsoft",
   "product": "Windows Kerberos / Active Directory",
   "product_class": "directory-kerberos",
   "protocol": "kerberos-ad",
   "cwe": "CWE-807",
   "cwe_source": "nvd",
   "cwe_group": "missing-auth",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2026-02-10",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-20849/"
  },
  {
   "id": "CVE-2026-23760",
   "vendor": "SmarterTools",
   "product": "SmarterMail",
   "product_class": "app-builtin-auth",
   "protocol": "other",
   "cwe": "CWE-288",
   "cwe_source": "nvd",
   "cwe_group": "missing-auth",
   "severity": "critical",
   "cvss": "",
   "kev": true,
   "kev_date_added": "2026-01-26",
   "disclosed": "2026-01-15",
   "days_disclosure_to_kev": 11,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-23760/"
  },
  {
   "id": "CVE-2026-24858",
   "vendor": "Fortinet",
   "product": "Fortinet products (FortiCloud SSO)",
   "product_class": "edge-gateway",
   "protocol": "other",
   "cwe": "CWE-288",
   "cwe_source": "brief",
   "cwe_group": "missing-auth",
   "severity": "critical",
   "cvss": "9.8",
   "kev": true,
   "kev_date_added": "2026-01-27",
   "disclosed": "2026-01-27",
   "days_disclosure_to_kev": 0,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-24858/"
  },
  {
   "id": "CVE-2026-25177",
   "vendor": "Microsoft",
   "product": "Active Directory (Kerberos SPNs)",
   "product_class": "directory-kerberos",
   "protocol": "kerberos-ad",
   "cwe": "CWE-641",
   "cwe_source": "nvd",
   "cwe_group": "signature-crypto",
   "severity": "high",
   "cvss": "8.8",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2026-03-10",
   "days_disclosure_to_kev": "",
   "technique": "kerberoasting",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-25177/"
  },
  {
   "id": "CVE-2026-2603",
   "vendor": "Red Hat (Keycloak)",
   "product": "Keycloak",
   "product_class": "idp-federation",
   "protocol": "saml",
   "cwe": "CWE-306",
   "cwe_source": "nvd",
   "cwe_group": "missing-auth",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2026-03-18",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-2603/"
  },
  {
   "id": "CVE-2026-27912",
   "vendor": "Microsoft",
   "product": "Active Directory (kpasswd)",
   "product_class": "directory-kerberos",
   "protocol": "kerberos-ad",
   "cwe": "CWE-285",
   "cwe_source": "nvd",
   "cwe_group": "authorization",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2026-04-14",
   "days_disclosure_to_kev": "",
   "technique": "kerberos-delegation-abuse",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-27912/"
  },
  {
   "id": "CVE-2026-34348",
   "vendor": "Microsoft",
   "product": "Windows Event Logging Service",
   "product_class": "mfa-authenticator",
   "protocol": "fido",
   "cwe": "CWE-693",
   "cwe_source": "nvd",
   "cwe_group": "authorization",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2026-07-14",
   "days_disclosure_to_kev": "",
   "technique": "token-replay-unbound-endpoint",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-34348/"
  },
  {
   "id": "CVE-2026-48558",
   "vendor": "SimpleHelp",
   "product": "SimpleHelp",
   "product_class": "pam-remote",
   "protocol": "oauth-oidc",
   "cwe": "CWE-347",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "critical",
   "cvss": "",
   "kev": true,
   "kev_date_added": "2026-06-29",
   "disclosed": "2026-05-12",
   "days_disclosure_to_kev": 48,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-48558/"
  },
  {
   "id": "CVE-2026-5430",
   "vendor": "WSO2",
   "product": "WSO2 API Manager, API Control Plane, Traffic Manager and Universal Gateway",
   "product_class": "edge-gateway",
   "protocol": "oauth-oidc",
   "cwe": "CWE-347",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "critical",
   "cvss": "10.0",
   "kev": true,
   "kev_date_added": "2026-09-24",
   "disclosed": "2026-05-03",
   "days_disclosure_to_kev": 144,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-5430/"
  },
  {
   "id": "CVE-2026-55040",
   "vendor": "Microsoft",
   "product": "Microsoft SharePoint Server",
   "product_class": "app-builtin-auth",
   "protocol": "oauth-oidc",
   "cwe": "CWE-347",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "critical",
   "cvss": "9.1",
   "kev": true,
   "kev_date_added": "2026-08-18",
   "disclosed": "2026-07-14",
   "days_disclosure_to_kev": 35,
   "technique": "token-replay-unbound-endpoint",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-55040/"
  },
  {
   "id": "CVE-2026-5712",
   "vendor": "SailPoint",
   "product": "SailPoint IdentityIQ",
   "product_class": "iga",
   "protocol": "iga",
   "cwe": "CWE-863",
   "cwe_source": "nvd",
   "cwe_group": "authorization",
   "severity": "high",
   "cvss": "",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2026-04-08",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-5712/"
  },
  {
   "id": "CVE-2026-63077",
   "vendor": "JetBrains",
   "product": "JetBrains TeamCity On-Premises",
   "product_class": "app-builtin-auth",
   "protocol": "other",
   "cwe": "CWE-502",
   "cwe_source": "nvd",
   "cwe_group": "injection-traversal",
   "severity": "critical",
   "cvss": "",
   "kev": true,
   "kev_date_added": "2026-08-05",
   "disclosed": "2026-07-27",
   "days_disclosure_to_kev": 9,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-63077/"
  },
  {
   "id": "CVE-2026-76460",
   "vendor": "Cisco",
   "product": "Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector",
   "product_class": "edge-gateway",
   "protocol": "radius",
   "cwe": "CWE-648",
   "cwe_source": "brief",
   "cwe_group": "missing-auth",
   "severity": "critical",
   "cvss": "10.0",
   "kev": true,
   "kev_date_added": "2026-09-16",
   "disclosed": "2026-09-16",
   "days_disclosure_to_kev": 0,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-76460/"
  },
  {
   "id": "CVE-2026-85102",
   "vendor": "Check Point",
   "product": "Check Point Quantum Security Gateway and Spark Firewall (Remote Access and Site-to-Site VPN)",
   "product_class": "edge-gateway",
   "protocol": "other",
   "cwe": "CWE-295",
   "cwe_source": "brief",
   "cwe_group": "signature-crypto",
   "severity": "critical",
   "cvss": "9.8",
   "kev": true,
   "kev_date_added": "2026-09-22",
   "disclosed": "2026-09-09",
   "days_disclosure_to_kev": 13,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-85102/"
  },
  {
   "id": "CVE-2026-88779",
   "vendor": "Citrix (Cloud Software Group)",
   "product": "NetScaler ADC and NetScaler Gateway",
   "product_class": "edge-gateway",
   "protocol": "saml",
   "cwe": "CWE-119",
   "cwe_source": "brief",
   "cwe_group": "memory-safety",
   "severity": "high",
   "cvss": "8.7",
   "kev": true,
   "kev_date_added": "2026-10-04",
   "disclosed": "2026-10-03",
   "days_disclosure_to_kev": 1,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-88779/"
  },
  {
   "id": "CVE-2026-89111",
   "vendor": "SAP",
   "product": "SAP Cloud SDK for Python (sap-cloud-sdk)",
   "product_class": "library-sdk",
   "protocol": "oauth-oidc",
   "cwe": "CWE-918",
   "cwe_source": "brief",
   "cwe_group": "injection-traversal",
   "severity": "critical",
   "cvss": "10.0",
   "kev": false,
   "kev_date_added": "",
   "disclosed": "2026-10-13",
   "days_disclosure_to_kev": "",
   "technique": "",
   "status": "patched",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-89111/"
  },
  {
   "id": "CVE-2026-94127",
   "vendor": "F5",
   "product": "F5 BIG-IP Access Policy Manager (APM)",
   "product_class": "edge-gateway",
   "protocol": "oauth-oidc",
   "cwe": "CWE-122",
   "cwe_source": "brief",
   "cwe_group": "memory-safety",
   "severity": "critical",
   "cvss": "9.8",
   "kev": true,
   "kev_date_added": "2026-09-22",
   "disclosed": "2026-09-22",
   "days_disclosure_to_kev": 0,
   "technique": "",
   "status": "actively-exploited",
   "incomplete_fix": false,
   "id_check": "ok",
   "id_check_note": "",
   "url": "https://startwithidentity.com/cves/cve-2026-94127/"
  }
 ]
}