PatchTheCVEpolis vulnerabilities and fixes
Recent CVEs affecting polis, with upgrade or downgrade steps. 1 tracked.
polis has 1 tracked vulnerability, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2026-03-26. Highest priority: CVE-2026-33506 (score 46/100).
- CVE-2026-33506 HIGH 8.8 UPGRADE Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Conne
FAQ
How do I fix polis vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is polis being exploited right now?
None of the tracked polis CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which polis CVE should I patch first?
CVE-2026-33506 currently ranks highest (46/100): Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Conne.