https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-22477.htmlhttps://patchthecve.com/cve/CVE-2024-22477.htmlWed, 17 Jun 2026 07:11:28 +0000LOW 1.8: A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. The impact is contained to admin console users only.https://patchthecve.com/cve/CVE-2024-22377.htmlhttps://patchthecve.com/cve/CVE-2024-22377.htmlWed, 17 Jun 2026 07:11:17 +0000MEDIUM 5.3: The deploy directory in PingFederate runtime nodes is reachable to unauthorized users.https://patchthecve.com/cve/CVE-2023-40545.htmlhttps://patchthecve.com/cve/CVE-2023-40545.htmlWed, 17 Jun 2026 06:18:23 +0000HIGH 8.8: Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests. https://patchthecve.com/cve/CVE-2023-39219.htmlhttps://patchthecve.com/cve/CVE-2023-39219.htmlWed, 17 Jun 2026 06:11:47 +0000HIGH 7.5: PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests https://patchthecve.com/cve/CVE-2023-37283.htmlhttps://patchthecve.com/cve/CVE-2023-37283.htmlWed, 17 Jun 2026 06:07:53 +0000HIGH 8.1: Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter https://patchthecve.com/cve/CVE-2023-34085.htmlhttps://patchthecve.com/cve/CVE-2023-34085.htmlWed, 17 Jun 2026 06:02:51 +0000LOW 2.6: When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request