A CVE ID is a name. The value is knowing who the attacker becomes.

Most CVE pages are written for scanners. They give you a vector string, a CPE that may never get filled in, and a paragraph copied from the vendor. That is useful if you are matching a software bill of materials. It is not useful if you are the person who has to tell a CISO whether this week's SAML bug means every admin is impersonable.

We built the identity CVE catalog for that person.

What you get

Each brief answers three questions, in that order:

1. What broke. The actual control that failed, in the product's own terms. Parser differential, PAC validation, alg:none, kpasswd skipping PAC_REQUESTOR_SID.
2. Why it matters for identity. Who the attacker becomes. A Global Admin in every Entra tenant is not the same class of event as a local DoS.
3. What to do this week. Patch the build string, rotate the signing key, hunt the rogue admin. Named controls, not "review your posture."

We highlight CISA KEV because that is the public list of "this is being used." We link vendor profiles, standards, and glossary terms the first time they earn it. We do not dump the NVD description.

Start with the protocol, not the ID

If you own a stack, start on the protocol page, not the CVE ID:

• SAML: wrapping and parser differentials, including ruby-saml, GHES, Keycloak, and FortiCloud SSO
• OAuth / OIDC / JWT: skipped signatures, audience mix-ups, skip-list bypasses
• Kerberos / Active Directory: PAC, PKINIT, S4U, KerberLoss, ResetNightmare
• FIDO2 / WebAuthn: Pass-the-Passkey and credential-type confusion
• Secrets managers: VaultFault and Conjur IAM-authenticator bypasses
• Cloud identity: Entra Actor tokens, CVSS 10.0, no customer patch

Each protocol page says how that protocol is failing this year, then lists every brief in the category. That is the page to drop in a team channel when someone asks "are we exposed to the SAML thing."

Why a community site is doing this

NIST moved NVD to a triage model in April 2026. It will fully enrich only a fraction of new CVEs. Identity flaws already punched above their weight: CVE-2025-55241 made every Entra tenant impersonable, CVE-2025-59718 was exploited three days after disclosure, and the ruby-saml series needed four CVEs before "we patched" was true.

Someone has to keep the identity-shaped list current, with practitioner context, without a vendor sponsorship attached. That is us. It is also you, if you want it.

How to make this yours

• Read and cite. The catalog is free, dated, and vendor-neutral. Link the brief, not a screenshot of NVD.
• Correct us. Stale patch status, a missing primary source, a 2026 Keycloak SAML ID we have not written yet. Email community@startwithidentity.com. Corrections are credited.
• Volunteer as a CVE Analyst. Two to three hours a week: triage an identity CVE, write the brief to the editorial standard, keep KEV status honest. Public byline. See the community roles.
• Subscribe. When we add a brief for a KEV identity item, it will show up in the newsletter and in identity news.

A CVE ID is a name. The value is knowing whether that name means someone can log in as you. Start with the catalog.