How many shibboleth service provider CVEs are in CISA KEV?

None of shibboleth service provider's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for shibboleth service provider vulnerabilities?

Yes — 1 of shibboleth service provider's CVEs have a known public exploit.

Which versions of shibboleth service provider are affected?

14 distinct shibboleth service provider versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in shibboleth service provider CVEs?

shibboleth service provider's CVEs most often map to these CWE weakness types: CWE-427 (Uncontrolled Search Path Element), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')).

How many critical shibboleth service provider vulnerabilities are there?

shibboleth service provider has 1 critical and 5 high-severity CVEs.

What is the average severity of shibboleth service provider CVEs?

The average CVSS base score across shibboleth service provider's scored CVEs is 7.1.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

shibboleth

8 CVEs

shibboleth service provider Vulnerabilities

Name: shibboleth service provider vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for service provider by shibboleth.

8

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

1

Public exploits

PoC or exploit code

7.1

Avg CVSS

2015–2025

Last updated September 10, 2025

Overview

shibboleth service provider has 8 published CVE records since 2015, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 1 have a known public exploit. The average CVSS base score across scored CVEs is 7.1.

This page aggregates every publicly disclosed vulnerability (CVE) affecting shibboleth service provider, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list. Affected platforms include windows.

Severity and exploitation

How the CVSS severity of shibboleth service provider's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1

High5

Medium2

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of shibboleth service provider's CVEs are currently listed in CISA's KEV catalog.

Public exploits

1

One of shibboleth service provider's CVEs has a known public exploit available.

Affected versions and CVEs

Browse every shibboleth service provider version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 2.6.11 CVE
< 3.2.11 CVE
< 3.4.11 CVE
<= 2.5.31 CVE
<= 3.5.01 CVE
2.0 <= v <= 2.01 CVE
3.0.0 <= v < 3.1.01 CVE
3.0.0 <= v < 3.2.21 CVE

Fixed in

> 3.5.01 CVE
2.6.11 CVE
3.1.01 CVE
3.2.11 CVE
3.2.21 CVE
3.4.11 CVE

Find a version

8 CVEs

Sort

Unauthenticated SQL Injection Vulnerability in Shibboleth Service Provider
CVE-2025-9943
Patch
Workaround
CWE-89
Critical · CVSS 9.1
EPSS 0.4% (29th pct)2025-09-10
High vulnerability · 2023-01-11
CVE-2023-22947
Public exploit
Patch
CWE-427
High · CVSS 7.3
EPSS 0.3% (23th pct)2023-01-11
High vulnerability · 2021-04-27
CVE-2021-31826
Patch
High · CVSS 7.5
EPSS 2.0% (79th pct)2021-04-27
Medium vulnerability · 2021-03-22
CVE-2021-28963
Patch
Medium · CVSS 5.3
EPSS 1.3% (67th pct)2021-03-22
High vulnerability · 2019-11-21
CVE-2019-19191
Patch
High · CVSS 7.8
EPSS 0.5% (39th pct)2019-11-21
High vulnerability · 2019-11-07
CVE-2010-2450
High · CVSS 7.5
EPSS 1.2% (65th pct)2019-11-07
High vulnerability · 2017-11-16
CVE-2017-16852
Patch
High · CVSS 8.1
EPSS 1.1% (62th pct)2017-11-16
Medium vulnerability · 2015-03-31
CVE-2015-2684
Medium · CVSS 4.0
EPSS 1.9% (78th pct)2015-03-31

Common weakness types

The CWE weakness categories most often found in shibboleth service provider CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many shibboleth service provider CVEs were published each year.

2015

1

2017

1

2019

2

2021

2

2023

1

2025

1

Other shibboleth products

Browse vulnerabilities for other products by shibboleth.

identity provider3 CVEs opensaml3 CVEs opensaml java2 CVEs xmltooling-c2 CVEs oidc op1 CVEs OpenSAML C++ library1 CVEs shibboleth-identity-provider1 CVEs shibboleth-sp1 CVEs

All shibboleth vulnerabilities

Frequently asked questions

Common questions about shibboleth service provider vulnerabilities.

How many CVEs does shibboleth service provider have?: shibboleth service provider has 8 published CVE records since 2015.
How many shibboleth service provider CVEs are in CISA KEV?: None of shibboleth service provider's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for shibboleth service provider vulnerabilities?: Yes — 1 of shibboleth service provider's CVEs have a known public exploit.
Which versions of shibboleth service provider are affected?: 14 distinct shibboleth service provider versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in shibboleth service provider CVEs?: shibboleth service provider's CVEs most often map to these CWE weakness types: CWE-427 (Uncontrolled Search Path Element), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')).
How many critical shibboleth service provider vulnerabilities are there?: shibboleth service provider has 1 critical and 5 high-severity CVEs.
What is the average severity of shibboleth service provider CVEs?: The average CVSS base score across shibboleth service provider's scored CVEs is 7.1.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track shibboleth service provider vulnerabilities

Monitor new shibboleth service provider vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing