https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-22477.htmlhttps://patchthecve.com/cve/CVE-2024-22477.htmlWed, 17 Jun 2026 07:11:28 +0000LOW 1.8: A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. The impact is contained to admin console users only.https://patchthecve.com/cve/CVE-2024-22377.htmlhttps://patchthecve.com/cve/CVE-2024-22377.htmlWed, 17 Jun 2026 07:11:17 +0000MEDIUM 5.3: The deploy directory in PingFederate runtime nodes is reachable to unauthorized users.https://patchthecve.com/cve/CVE-2023-40545.htmlhttps://patchthecve.com/cve/CVE-2023-40545.htmlWed, 17 Jun 2026 06:18:23 +0000HIGH 8.8: Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests. https://patchthecve.com/cve/CVE-2023-36496.htmlhttps://patchthecve.com/cve/CVE-2023-36496.htmlWed, 17 Jun 2026 06:06:24 +0000HIGH 7.7: Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server. https://patchthecve.com/cve/CVE-2023-39930.htmlhttps://patchthecve.com/cve/CVE-2023-39930.htmlWed, 17 Jun 2026 06:12:58 +0000HIGH 7.5: A first-factor authentication bypass vulnerability exists in the PingFederate with PingID Radius PCV when a MSCHAP authentication request is sent via a maliciously crafted RADIUS client request.https://patchthecve.com/cve/CVE-2023-39231.htmlhttps://patchthecve.com/cve/CVE-2023-39231.htmlWed, 17 Jun 2026 06:11:48 +0000HIGH 7.3: PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered device. A threat actor may be able to exploit this vulnerability to register their own MFA device if they have knowledge of a victim user's firsthttps://patchthecve.com/cve/CVE-2023-39219.htmlhttps://patchthecve.com/cve/CVE-2023-39219.htmlWed, 17 Jun 2026 06:11:47 +0000HIGH 7.5: PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests https://patchthecve.com/cve/CVE-2023-37283.htmlhttps://patchthecve.com/cve/CVE-2023-37283.htmlWed, 17 Jun 2026 06:07:53 +0000HIGH 8.1: Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter https://patchthecve.com/cve/CVE-2023-34085.htmlhttps://patchthecve.com/cve/CVE-2023-34085.htmlWed, 17 Jun 2026 06:02:51 +0000LOW 2.6: When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request