CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 26 min ago

Severity mix

CVSS base severity, as scored in NVD

Critical: 4038%
High: 2,48148%
Medium: 2,01039%
Low or not scored: 2415%

CVEs: 5,135; Last two years
Critical: 403; CVSS 9.0 and above
High: 2,481; CVSS 7.0 to 8.9
Known exploited: 56; On CISA's KEV list

CVEs published

By month, last two years

Peak 834 · October 2026

Most CVEs

In each company's software, last two years

Latest CVEs

9.8Crit
CVE-2024-54465 (opens in a new tab)
A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.2. An app may be able to elevate privileges.
Apple (iCloud, App Store and services)· Dec 12, 2024
7.8High
CVE-2024-49142 (opens in a new tab)
Microsoft Access Remote Code Execution Vulnerability
Microsoft 365· Dec 12, 2024
7.4High
CVE-2024-49070 (opens in a new tab)
Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft 365· Dec 12, 2024
7.8High
CVE-2024-49069 (opens in a new tab)
Microsoft Excel Remote Code Execution Vulnerability
Microsoft 365· Dec 12, 2024
8.2High
CVE-2024-49068 (opens in a new tab)
Microsoft SharePoint Elevation of Privilege Vulnerability
Microsoft 365· Dec 12, 2024
5.5Med
CVE-2024-49065 (opens in a new tab)
Microsoft Office Remote Code Execution Vulnerability
Microsoft 365· Dec 12, 2024
6.5Med
CVE-2024-49064 (opens in a new tab)
Microsoft SharePoint Information Disclosure Vulnerability
Microsoft 365· Dec 12, 2024
6.5Med
CVE-2024-49062 (opens in a new tab)
Microsoft SharePoint Information Disclosure Vulnerability
Microsoft 365· Dec 12, 2024
7.0High
CVE-2024-49059 (opens in a new tab)
Microsoft Office Elevation of Privilege Vulnerability
Microsoft 365· Dec 12, 2024
7.8High
CVE-2024-43600 (opens in a new tab)
Microsoft Office Elevation of Privilege Vulnerability
Microsoft 365· Dec 12, 2024
7.1High
CVE-2024-12363 (opens in a new tab)
Insufficient permissions in the TeamViewer Patch & Asset Management component prior to version 24.12 on Windows allows a local authenticated user to delete arbitrary files. TeamViewer Patch & Asset Management is part of TeamViewer Remote Management.
TeamViewer· Dec 11, 2024
5.5Med
CVE-2024-49541 (opens in a new tab)
Illustrator versions 29.0.0, 28.7.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Adobe· Dec 10, 2024
2.7Low
CVE-2024-55550 (opens in a new tab)Known exploited
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation.
Mitel· Dec 10, 2024
6.8Med
CVE-2024-12236 (opens in a new tab)
A security issue exists in Vertex Gemini API for customers using VPC-SC. By utilizing a custom crafted file URI for image input, data exfiltration is possible due to requests being routed outside the VPC-SC security perimeter, circumventing the intended security restrictions of VPC-SC. No further fix actions are needed. Google Cloud Platform implemented a fix to return an error message when a media file URL is specified in the fileUri parameter and VPC Service Controls is enabled. Other use cases are unaffected.
Google Cloud· Dec 10, 2024
7.8High
CVE-2024-11608 (opens in a new tab)
A maliciously crafted SKP file, when linked or imported into Autodesk Revit, can be used to cause a Heap-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Autodesk· Dec 9, 2024
7.8High
CVE-2024-11454 (opens in a new tab)
A maliciously crafted DLL file, when placed in the same directory as an RVT file could be loaded by Autodesk Revit, and execute arbitrary code in the context of the current process due to an untrusted search patch being utilized.
Autodesk· Dec 9, 2024
5.5Med
CVE-2024-11268 (opens in a new tab)
A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read. A malicious actor can leverage this vulnerability to cause a crash or could lead to an arbitrary memory leak.
Autodesk· Dec 9, 2024
4.4Med
CVE-2024-0139 (opens in a new tab)
NVIDIA Base Command Manager and Bright Cluster Manager for Linux contain an insecure temporary file vulnerability. A successful exploit of this vulnerability might lead to denial of service.
NVIDIA· Dec 6, 2024
8.8High
CVE-2024-0130 (opens in a new tab)
NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue by sending a malformed request through the Ethernet management interface. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, and information disclosure.
NVIDIA· Dec 6, 2024
4.3Med
CVE-2024-12247 (opens in a new tab)
Mattermost versions 9.7.x <= 9.7.5, 9.8.x <= 9.8.2 and 9.9.x <= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated.
Mattermost Cloud· Dec 5, 2024
4.8Med
CVE-2024-45717 (opens in a new tab)
The SolarWinds Platform was susceptible to a XSS vulnerability that affects the search and node information section of the user interface. This vulnerability requires authentication and requires user interaction.
SolarWinds· Dec 4, 2024
9.8Crit
CVE-2024-10905 (opens in a new tab)
IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ application directory that should be protected.
SailPoint· Dec 2, 2024
5.3Med
CVE-2024-11599 (opens in a new tab)
Mattermost versions 10.0.x <= 10.0.1, 10.1.x <= 10.1.1, 9.11.x <= 9.11.3, 9.5.x <= 9.5.11 fail to properly validate email addresses which allows an unauthenticated user to bypass email domain restrictions via carefully crafted input on email registration.
Mattermost Cloud· Nov 28, 2024
6.4Med
CVE-2024-21703 (opens in a new tab)
This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Windows installations. This Security Misconfiguration vulnerability, with a CVSS Score of 6.4 allows an authenticated attacker of the Windows host to read sensitive information about the Confluence Data Center configuration which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction. Atlassian recommends that Confluence Data Center and Server customers upgrade to the latest version, if you are unable t
Confluence· Nov 27, 2024
7.1High
CVE-2024-5921 (opens in a new tab)
An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint. Please subscribe to our RSS feed https://security.paloaltonetworks.com/rss.xml to be alerted to new updates to this and other advisories.
Palo Alto Networks· Nov 27, 2024
7.6High
CVE-2024-49053 (opens in a new tab)
Microsoft Dynamics 365 Sales Spoofing Vulnerability
Microsoft 365· Nov 26, 2024
9.8Crit
CVE-2024-49052 (opens in a new tab)
Missing authentication for critical function in Microsoft Azure PolicyWatch allows an unauthorized attacker to elevate privileges over a network.
Microsoft Azure· Nov 26, 2024
9.6Crit
CVE-2024-49038 (opens in a new tab)
Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorized attacker leads to elevation of privilege over a network.
Microsoft 365· Nov 26, 2024
5.3Med
CVE-2024-10240 (opens in a new tab)
An issue has been discovered in GitLab EE affecting all versions starting from 17.3 before 17.3.7, all versions starting from 17.4 before 17.4.4, all versions starting from 17.5 before 17.5.2 in which an unauthenticated user may be able to read some information about an MR in a private project, under certain circumstances.
GitLab· Nov 26, 2024
7.5High
CVE-2024-8237 (opens in a new tab)
A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 12.6 prior to 17.4.5, 17.5 prior to 17.5.3, and 17.6 prior to 17.6.1. An attacker could cause a denial of service with a crafted cargo.toml file.
GitLab· Nov 26, 2024
7.5High
CVE-2024-8177 (opens in a new tab)
An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.4.5, starting from 17.5 prior to 17.5.3, starting from 17.6 prior to 17.6.1 which could cause Denial of Service via integrating a malicious harbor registry.
GitLab· Nov 26, 2024
8.8High
CVE-2024-8114 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. This issue allows an attacker with access to a victim's Personal Access Token (PAT) to escalate privileges.
GitLab· Nov 26, 2024
7.5High
CVE-2024-11828 (opens in a new tab)
A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted API calls. This was a regression of an earlier patch.
GitLab· Nov 26, 2024
7.5High
CVE-2024-11669 (opens in a new tab)
An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints could potentially allow unauthorized access to sensitive data due to overly broad application of token scopes.
GitLab· Nov 26, 2024
5.3Med
CVE-2024-11668 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Long-lived connections could potentially bypass authentication controls, allowing unauthorized access to streaming results.
GitLab· Nov 26, 2024
5.4Med
CVE-2024-8236 (opens in a new tab)
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter of the Icon widget in all versions up to, and including, 3.25.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Elementor· Nov 26, 2024
7.0High
CVE-2024-27134 (opens in a new tab)
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.
JFrog· Nov 25, 2024
9.8Crit
CVE-2024-0138 (opens in a new tab)
NVIDIA Base Command Manager contains a missing authentication vulnerability in the CMDaemon component. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
NVIDIA· Nov 23, 2024
7.6High
CVE-2024-0122 (opens in a new tab)
NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an attacker may cause an unauthorized action. A successful exploit of this vulnerability may lead to partial denial of service and confidential information disclosure.
NVIDIA· Nov 23, 2024
8.8High
CVE-2024-11394 (opens in a new tab)
Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability
Hugging Face· Nov 22, 2024
8.8High
CVE-2024-11393 (opens in a new tab)
Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerab
Hugging Face· Nov 22, 2024
8.8High
CVE-2024-11392 (opens in a new tab)
Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of configuration files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vuln
Hugging Face· Nov 22, 2024
8.3High
CVE-2024-9710 (opens in a new tab)
PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PostHog. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the database_schema method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-25351.
PostHog· Nov 22, 2024
5.3Med
CVE-2024-53253 (opens in a new tab)
Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario where a specific error message generated by the Sentry platform could include a plaintext Client ID and Client Secret for an application integration. The Client ID and Client Secret would not be displayed in the UI, but would be returned in the underlying HTTP response to the end user. This could occur under the following conditions: An app installation made use of a Search UI component with the `async` flag set to true (default: true); auser types types into
Sentry· Nov 22, 2024
7.5High
CVE-2024-45422 (opens in a new tab)
Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial of service via network access.
Zoom· Nov 19, 2024
6.5Med
CVE-2024-45420 (opens in a new tab)
Uncontrolled resource consumption in some Zoom Apps before version 6.2.0 may allow an authenticated user to conduct a denial of service via network access.
Zoom· Nov 19, 2024
7.5High
CVE-2024-45419 (opens in a new tab)
Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via network access.
Zoom· Nov 19, 2024
8.8High
CVE-2024-51503 (opens in a new tab)
A security agent manual scan command injection vulnerability in the Trend Micro Deep Security 20 Agent could allow an attacker to escalate privileges and execute arbitrary code on an affected machine. In certain circumstances, attackers that have legitimate access to the domain may be able to remotely inject commands to other machines in the same domain. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability locally and must have domain user privileges to affect other machines.
Trend Micro· Nov 19, 2024
6.5Med
CVE-2024-10524 (opens in a new tab)
Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.
JFrog· Nov 19, 2024
6.1Med
CVE-2024-10103 (opens in a new tab)
In the process of testing the MailPoet WordPress plugin before 5.3.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor
WordPress.com (Automattic)· Nov 19, 2024

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 26 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.