Uaa

This hub aggregates every CVE we track for Uaa, a product in the cloud saas space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 10 most recently published vulnerabilities affecting Uaa.

• CVE-2026-47840LDAP StartTLS unconditionally disables hostname verification7.5Jul 9, 2026
• CVE-2026-41005UAA accepts SAML Encrypted Assertions authentication bypass9.0Jun 11, 2026
• CVE-2026-22723UAA User Token Revocation logic error6.5Mar 5, 2026
• CVE-2025-22246CVE-2025-22246 – UAA Private Key Exposure3.0May 13, 2025
• CVE-2022-31197SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc7.1Aug 3, 2022
• CVE-2020-5402UAA fails to check the state parameter when authenticating with external IDPs8.8Feb 27, 2020
• CVE-2018-15761UAA Privilege Escalation9.9Nov 19, 2018
• CVE-2018-11082Cloud Foundry UAA MFA does not prevent brute force of MFA code6.6Oct 5, 2018
• CVE-2018-1190An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions ...6.1Jan 4, 2018
• CVE-2015-5171The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified ...9.8Oct 24, 2017