openfga openfga

Name: openfga openfga
Brand: openfga

productUS

cpe:2.3:a:openfga:openfga:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

by severity

11critical7high6medium0low

updated 2026-10-27

vulnerabilities (26)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2022-39342US	critical9.8OT elevated	1.14% (67th)	—	0.2.4	2022-10-25	< 0.2.4
CVE-2022-39341US	critical9.8OT elevated	1.14% (67th)	—	0.2.4	2022-10-25	< 0.2.4
CVE-2023-35933US	high7.5	1.13% (66th)	—	1.1.1	2023-06-26	< 1.1.1
CVE-2022-23542US	critical9.8	0.99% (62nd)	—	0.3.1	2022-12-20	< 0.3.1
CVE-2023-43645US	medium5.9	0.94% (61st)	—	1.3.2	2023-09-27	< 1.3.2
CVE-2022-39340US	medium5.3OT elevated	0.91% (60th)	—	0.2.4	2022-10-25	< 0.2.4
CVE-2024-23820US	medium6.5	0.73% (54th)	—	1.4.3	2024-01-26	< 1.4.3
CVE-2024-31452US	critical9.8OT elevated	0.66% (51st)	—	1.5.3	2024-04-16	1.5.0 → 1.5.3
CVE-2023-45810US	high7.5	0.61% (49th)	—	1.3.4	2023-10-17	< 1.3.4
CVE-2023-40579US	medium6.5	0.55% (46th)	—	1.3.1	2023-08-25	< 1.3.1
CVE-2024-42473US	critical9.8OT elevated	0.53% (44th)	—	no fix	2024-08-12	2 versions
CVE-2025-48371US	high8.8	0.50% (43rd)	—	1.8.13	2025-05-22	1.8.0 → 1.8.13
CVE-2022-39352US	critical9.8OT elevated	0.46% (39th)	—	0.2.5	2022-11-08	< 0.2.5
CVE-2024-56323US	critical9.8	0.44% (38th)	—	1.8.3	2025-01-13	1.3.8 → 1.8.3
CVE-2025-25196US	critical9.8	0.43% (37th)	—	1.8.5	2025-02-19	< 1.8.5
CVE-2026-55689US	high8.1	0.41% (35th)	—	1.18.0	2026-07-09	< 1.18.0
CVE-2025-46331US	critical9.8OT elevated	0.39% (33rd)	—	1.8.11	2025-04-30	1.3.6 → 1.8.11
CVE-2026-24851US	high8.8OT elevated	0.35% (28th)	—	1.11.3	2026-02-06	1.8.5 → 1.11.3
CVE-2026-55170US	medium5.4	0.34% (27th)	—	1.18.0	2026-07-09	< 1.18.0
CVE-2025-55213US	critical9.8OT elevated	0.32% (25th)	—	1.9.5	2025-08-18	1.9.3 → 1.9.5
CVE-2025-64751US	high8.8	0.31% (24th)	—	1.11.1	2025-11-21	1.4.0 → 1.11.1
CVE-2026-40293US	—	0.29% (21st)	—	1.14.0	2026-04-17	0.1.4 → 1.14.0
CVE-2026-33729US	critical9.8OT elevated	0.25% (16th)	—	1.13.1	2026-03-27	< 1.13.1
CVE-2026-34972US	high8.8OT elevated	0.21% (11th)	—	1.14.0	2026-04-06	1.8.0 → 1.14.0
CVE-2026-41131US	—OT elevated	0.14% (4th)	—	1.14.1	2026-04-22	< 1.14.1
CVE-2026-48096US	medium5.3OT elevated	0.10% (1st)	—	1.16.0	2026-06-10	< 1.16.0

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-863Incorrect Authorization11 CVEs
CWE-285Improper Authorization10 CVEs
CWE-284Improper Access Control2 CVEs
CWE-345Insufficient Verification of Data Authenticity2 CVEs
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')2 CVEs
CWE-1289Improper Validation of Unsafe Equivalence in Input1 CVEs
CWE-178Improper Handling of Case Sensitivity1 CVEs
CWE-20Improper Input Validation1 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE26 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan