PatchTheCVEory vulnerabilities
Recent CVEs affecting ory products. 7 tracked.
ory has 7 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 7. Most recent: 2026-03-26. Highest priority: CVE-2026-33494 (score 51/100).
- CVE-2026-33506 HIGH 8.8 UPGRADE Ory Polis, formerly known as BoxyHQ Jackson, bridges or proxies a SAML login flow to OAuth 2.0 or OpenID Conne
- CVE-2026-33505 HIGH 7.2 UPGRADE Ory Keto is am open source authorization server for managing permissions at scale
- CVE-2026-33504 HIGH 7.2 UPGRADE Ory Hydra is an OAuth 2.0 Server and OpenID Connect Provider
- CVE-2026-33503 HIGH 7.2 UPGRADE Ory Kratos is an identity, user management and authentication system for cloud services
- CVE-2026-33496 HIGH 8.1 UPGRADE ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP reques
- CVE-2026-33495 MEDIUM 6.5 UPGRADE ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP reques
- CVE-2026-33494 CRITICAL 10.0 UPGRADE ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP reques
FAQ
How do I fix ory vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is ory being exploited right now?
None of the tracked ory CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which ory CVE should I patch first?
CVE-2026-33494 currently ranks highest (51/100): ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP reques.