CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 9 min ago

Severity mix

CVSS base severity, as scored in NVD

Critical: 4038%
High: 2,48148%
Medium: 2,01039%
Low or not scored: 2415%

CVEs: 5,135; Last two years
Critical: 403; CVSS 9.0 and above
High: 2,481; CVSS 7.0 to 8.9
Known exploited: 56; On CISA's KEV list

CVEs published

By month, last two years

Peak 834 · October 2026

Most CVEs

In each company's software, last two years

Latest CVEs

6.7Med
CVE-2025-21357 (opens in a new tab)
Microsoft Outlook Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
7.8High
CVE-2025-21356 (opens in a new tab)
Microsoft Office Visio Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
7.8High
CVE-2025-21354 (opens in a new tab)
Microsoft Excel Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
7.2High
CVE-2025-21348 (opens in a new tab)
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
7.8High
CVE-2025-21346 (opens in a new tab)
Microsoft Office Security Feature Bypass Vulnerability
Microsoft 365· Jan 14, 2025
7.8High
CVE-2025-21345 (opens in a new tab)
Microsoft Office Visio Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
7.8High
CVE-2025-21344 (opens in a new tab)
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
7.8High
CVE-2025-21338 (opens in a new tab)
GDI+ Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
7.8High
CVE-2025-21186 (opens in a new tab)
Microsoft Access Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
6.8Med
CVE-2024-12086 (opens in a new tab)
A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.
SUSE· Jan 14, 2025
7.5High
CVE-2024-12085 (opens in a new tab)
A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.
SUSE· Jan 14, 2025
7.7High
CVE-2025-0107 (opens in a new tab)
An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.
Palo Alto Networks· Jan 11, 2025
6.9Med
CVE-2025-0106 (opens in a new tab)
A wildcard expansion vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to enumerate files on the host filesystem.
Palo Alto Networks· Jan 11, 2025
6.9Med
CVE-2025-0105 (opens in a new tab)
An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files accessible to the www-data user on the host filesystem.
Palo Alto Networks· Jan 11, 2025
7.0High
CVE-2025-0104 (opens in a new tab)
A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.
Palo Alto Networks· Jan 11, 2025
9.2Crit
CVE-2025-0103 (opens in a new tab)
An SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. This vulnerability also enables attackers to create and read arbitrary files on the Expedition system.
Palo Alto Networks· Jan 11, 2025
6.5Med
CVE-2025-21380 (opens in a new tab)
Improper access control in Azure SaaS Resources allows an authorized attacker to disclose information over a network.
Microsoft Azure· Jan 9, 2025
6.6Med
CVE-2024-13296 (opens in a new tab)
Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1.
Mailjet· Jan 9, 2025
3.5Low
CVE-2024-13261 (opens in a new tab)
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia DAM allows Cross Site Request Forgery.This issue affects Acquia DAM: from 0.0.0 before 1.0.13, from 1.1.0 before 1.1.0-beta3.
Acquia· Jan 9, 2025
3.8Low
CVE-2025-22449 (opens in a new tab)
Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allow_open_invite" field via making their team public.
Mattermost Cloud· Jan 9, 2025
5.3Med
CVE-2025-22445 (opens in a new tab)
Mattermost versions 10.x <= 10.2 fail to accurately reflect missing settings, which allows confusion for admins regarding a Calls security-sensitive configuration via incorrect UI reporting.
Mattermost Cloud· Jan 9, 2025
6.5Med
CVE-2025-20033 (opens in a new tab)
Mattermost versions 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post types, which allows attackers to deny service to users with the sysconsole_read_plugins permission via creating a post with the custom_pl_notification type and specific props.
Mattermost Cloud· Jan 9, 2025
5.4Med
CVE-2024-13041 (opens in a new tab)
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. When a user is created via the SAML provider, the external groups setting overrides the external provider configuration. As a result, the user may not be marked as external thereby giving those users access to internal projects or groups.
GitLab· Jan 9, 2025
4.3Med
CVE-2024-6324 (opens in a new tab)
An issue was discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. It was possible to trigger a DoS by creating cyclic references between epics.
GitLab· Jan 9, 2025
4.3Med
CVE-2024-12431 (opens in a new tab)
An issue was discovered in GitLab CE/EE affecting all versions starting from 15.5 before 17.5.5, 17.6 before 17.6.3, and 17.7 before 17.7.1, in which unauthorized users could manipulate the status of issues in public projects.
GitLab· Jan 8, 2025
6.5Med
CVE-2025-0194 (opens in a new tab)
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. Under certain conditions, access tokens may have been logged when API requests were made in a specific manner.
GitLab· Jan 8, 2025
7.5High
CVE-2025-22390 (opens in a new tab)
An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS due to insufficient enforcement of password complexity requirements. The application permits users to set passwords with a minimum length of 6 characters, lacking adequate complexity to resist modern attack techniques such as password spraying or offline password cracking.
Optimizely· Jan 4, 2025
8.0High
CVE-2025-22389 (opens in a new tab)
An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS, where the application does not properly validate uploaded files. This allows the upload of potentially malicious file types, including .docm .html. When accessed by application users, these files can be used to execute malicious actions or compromise users' systems.
Optimizely· Jan 4, 2025
5.7Med
CVE-2025-22388 (opens in a new tab)
An issue was discovered in Optimizely EPiServer.CMS.Core before 12.22.0. A high-severity Stored Cross-Site Scripting (XSS) vulnerability exists in the CMS, allowing malicious actors to inject and execute arbitrary JavaScript code, potentially compromising user data, escalating privileges, or executing unauthorized actions. The issue exists in multiple areas, including content editing, link management, and file uploads.
Optimizely· Jan 4, 2025
7.5High
CVE-2025-22387 (opens in a new tab)
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be leveraged for session hijacking.
Optimizely· Jan 4, 2025
7.3High
CVE-2025-22386 (opens in a new tab)
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessions to still be active and usable.
Optimizely· Jan 4, 2025
5.9Med
CVE-2025-22385 (opens in a new tab)
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does not require email confirmation. This medium-severity issue allows the mass creation of accounts. This could affect database storage; also, non-requested storefront accounts can be created on behalf of visitors.
Optimizely· Jan 4, 2025
7.5High
CVE-2025-22384 (opens in a new tab)
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific scenarios where requests are altered before reaching the server.
Optimizely· Jan 4, 2025
4.6Med
CVE-2025-22383 (opens in a new tab)
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity input validation issue exists in the Commerce B2B application, affecting the Contact Us functionality. This allows visitors to send e-mail messages that could contain unfiltered HTML markup in specific scenarios.
Optimizely· Jan 4, 2025
5.3Med
CVE-2024-56332 (opens in a new tab)
Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service (DoS) attack that allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution. This vulnerability can also be used as a Denial of Wallet (DoW) attack when deployed in providers billing by response times. (Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low du
Vercel· Jan 3, 2025
7.3High
CVE-2024-55955 (opens in a new tab)
An incorrect permissions assignment vulnerability in Trend Micro Deep Security 20.0 agents between versions 20.0.1-9400 and 20.0.1-23340 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Trend Micro· Dec 31, 2024
7.8High
CVE-2024-55917 (opens in a new tab)
An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Trend Micro· Dec 31, 2024
7.8High
CVE-2024-55632 (opens in a new tab)
A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Trend Micro· Dec 31, 2024
7.8High
CVE-2024-55631 (opens in a new tab)
An engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Trend Micro· Dec 31, 2024
8.2High
CVE-2024-53647 (opens in a new tab)
Trend Micro ID Security, version 3.0 and below contains a vulnerability that could allow an attacker to send an unlimited number of email verification requests without any restriction, potentially leading to abuse or denial of service.
Trend Micro· Dec 31, 2024
7.8High
CVE-2024-52050 (opens in a new tab)
A LogServer arbitrary file creation vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Trend Micro· Dec 31, 2024
7.8High
CVE-2024-52049 (opens in a new tab)
A LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. This vulnerability is similar to, but not identical to CVE-2024-52048. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Trend Micro· Dec 31, 2024
7.8High
CVE-2024-52048 (opens in a new tab)
A LogServer link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations. This vulnerability is similar to, but not identical to CVE-2024-52049. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Trend Micro· Dec 31, 2024
8.8High
CVE-2024-52047 (opens in a new tab)
A widget local file inclusion vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Trend Micro· Dec 31, 2024
7.8High
CVE-2024-13043 (opens in a new tab)
Panda Security Dome Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Hotspot Shield. By creating a junction, an attacker can abuse the application to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-2
WatchGuard· Dec 30, 2024
5.5Med
CVE-2024-12754 (opens in a new tab)
AnyDesk Link Following Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of background images. By creating a junction, an attacker can abuse the service to read arbitrary files. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-23940.
AnyDesk· Dec 30, 2024
8.7High
CVE-2024-3393 (opens in a new tab)Known exploited
A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.
Palo Alto Networks· Dec 27, 2024
8.3High
CVE-2024-12908 (opens in a new tab)
Delinea addressed a reported case on Secret Server v11.7.31 (protocol handler version 6.0.3.26) where, within the protocol handler function, URI's were compared before normalization and canonicalization, potentially leading to over matching against the approved list. If this attack were successfully exploited, a remote attacker may be able to convince a user to visit a malicious web-page, or open a malicious document which could trigger the vulnerable handler, allowing them to execute arbitrary code on the user's machine. Delinea added additional validation that the downloaded installer's batc
Delinea· Dec 26, 2024
6.1Med
CVE-2024-10858 (opens in a new tab)
The Jetpack WordPress plugin before 14.1 does not properly checks the postmessage origin in its 13.x versions, allowing it to be bypassed and leading to DOM-XSS. The issue only affects websites hosted on WordPress.com.
WordPress.com (Automattic)· Dec 25, 2024
8.6High
CVE-2024-12746 (opens in a new tab)
A SQL injection in the Amazon Redshift ODBC Driver v2.1.5.0 (Windows or Linux) allows a user to gain escalated privileges via the SQLTables or SQLColumns Metadata APIs. Users are recommended to upgrade to the driver version 2.1.6.0 or revert to driver version 2.1.4.0.
Amazon Web Services· Dec 24, 2024

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 9 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.