CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 35 min ago

Severity mix

CVSS base severity, as scored in NVD

Critical: 4038%
High: 2,48148%
Medium: 2,01039%
Low or not scored: 2415%

CVEs: 5,135; Last two years
Critical: 403; CVSS 9.0 and above
High: 2,481; CVSS 7.0 to 8.9
Known exploited: 56; On CISA's KEV list

CVEs published

By month, last two years

Peak 834 · October 2026

Most CVEs

In each company's software, last two years

Latest CVEs

6.9Med
CVE-2024-9474 (opens in a new tab)Known exploited
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
Palo Alto Networks· Nov 18, 2024
9.3Crit
CVE-2024-0012 (opens in a new tab)Known exploited
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice depl
Palo Alto Networks· Nov 18, 2024
5.2Med
CVE-2024-11023 (opens in a new tab)
Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow an actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.
Firebase· Nov 18, 2024
7.8High
CVE-2024-9500 (opens in a new tab)
A maliciously crafted DLL file when placed in temporary files and folders that are leveraged by the Autodesk Installer could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to insecure privilege management.
Autodesk· Nov 15, 2024
8.8High
CVE-2024-49060 (opens in a new tab)
Azure Stack HCI Elevation of Privilege Vulnerability
Microsoft Azure· Nov 15, 2024
6.1Med
CVE-2024-9356 (opens in a new tab)
The Yotpo: Product & Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'yotpo_user_email' and 'yotpo_user_name' parameters in all versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Yotpo· Nov 15, 2024
9.6Crit
CVE-2024-52308 (opens in a new tab)
The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh codespace logs` commands. This has been patched in the cli v2.62.0. Developers connect to remote codespaces through an SSH server running within the devcontainer, which is generally provided through the [default devcontainer image]( https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-... https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-conf
GitHub· Nov 14, 2024
7.2High
CVE-2024-37285 (opens in a new tab)
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv and Kibana privileges https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html assigned to them. The following Elasticsearch indices permissions are required * write privilege on the system indices .kibana_inges
Elastic Cloud· Nov 14, 2024
8.1High
CVE-2024-10921 (opens in a new tab)
An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and including 8.0.2.
MongoDB Atlas· Nov 14, 2024
7.5High
CVE-2024-9633 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.4.2, all versions starting from 17.5 before 17.5.4, all versions starting from 17.6 before 17.6.2. This issue allows an attacker to create a group with a name matching an existing unique Pages domain, potentially leading to domain confusion attacks.
GitLab· Nov 14, 2024
6.1Med
CVE-2024-8648 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 16 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. The vulnerability could allow an attacker to inject malicious JavaScript code in Analytics Dashboards through a specially crafted URL.
GitLab· Nov 14, 2024
6.5Med
CVE-2024-7404 (opens in a new tab)
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 prior to 17.5.2, which could have allowed an attacker gaining full API access as the victim via the Device OAuth flow.
GitLab· Nov 14, 2024
8.8High
CVE-2024-9693 (opens in a new tab)
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 prior to 17.5.2, which could have allowed unauthorized access to the Kubernetes agent in a cluster under specific configurations.
GitLab· Nov 14, 2024
5.4Med
CVE-2024-8180 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. Improper output encoding could lead to XSS if CSP is not enabled.
GitLab· Nov 14, 2024
8.7High
CVE-2024-9472 (opens in a new tab)
A null pointer dereference in Palo Alto Networks PAN-OS software on PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series hardware platforms when Decryption policy is enabled allows an unauthenticated attacker to crash PAN-OS by sending specific traffic through the data plane, resulting in a denial of service (DoS) condition. Repeated attempts to trigger this condition will result in PAN-OS entering maintenance mode. Palo Alto Networks VM-Series, Cloud NGFW, and Prisma Access are not affected. This issue only affects PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series
Palo Alto Networks· Nov 14, 2024
4.6Med
CVE-2024-5920 (opens in a new tab)
A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write Panorama administrator to push a specially crafted configuration to a PAN-OS node. This enables impersonation of a legitimate PAN-OS administrator who can perform restricted actions on the PAN-OS node after the execution of JavaScript in the legitimate PAN-OS administrator's browser.
Palo Alto Networks· Nov 14, 2024
5.1Med
CVE-2024-5919 (opens in a new tab)
A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from firewalls to an attacker controlled server. This attack requires network access to the firewall management interface.
Palo Alto Networks· Nov 14, 2024
5.3Med
CVE-2024-5918 (opens in a new tab)
An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted client certificate to connect to an impacted GlobalProtect portal or GlobalProtect gateway as a different legitimate user. This attack is possible only if you "Allow Authentication with User Credentials OR Client Certificate."
Palo Alto Networks· Nov 14, 2024
2.1Low
CVE-2024-5917 (opens in a new tab)
A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible.
Palo Alto Networks· Nov 14, 2024
6.8Med
CVE-2024-2552 (opens in a new tab)
A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management plane and delete files on the firewall.
Palo Alto Networks· Nov 14, 2024
8.7High
CVE-2024-2551 (opens in a new tab)
A null pointer dereference vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop a core system service on the firewall by sending a crafted packet through the data plane that causes a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the firewall entering maintenance mode.
Palo Alto Networks· Nov 14, 2024
8.7High
CVE-2024-2550 (opens in a new tab)
A null pointer dereference vulnerability in the GlobalProtect gateway in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop the GlobalProtect service on the firewall by sending a specially crafted packet that causes a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the firewall entering maintenance mode.
Palo Alto Networks· Nov 14, 2024
5.1Med
CVE-2024-9476 (opens in a new tab)
A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizations feature to isolate resources on their Grafana instance.
Grafana Cloud· Nov 13, 2024
7.2High
CVE-2024-49042 (opens in a new tab)
Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability
Microsoft Azure· Nov 12, 2024
7.2High
CVE-2024-43613 (opens in a new tab)
Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability
Microsoft Azure· Nov 12, 2024
7.5High
CVE-2024-49040 (opens in a new tab)
Microsoft Exchange Server Spoofing Vulnerability
Microsoft 365· Nov 12, 2024
7.5High
CVE-2024-49033 (opens in a new tab)
Microsoft Word Security Feature Bypass Vulnerability
Microsoft 365· Nov 12, 2024
7.8High
CVE-2024-49032 (opens in a new tab)
Microsoft Office Graphics Remote Code Execution Vulnerability
Microsoft 365· Nov 12, 2024
7.8High
CVE-2024-49031 (opens in a new tab)
Microsoft Office Graphics Remote Code Execution Vulnerability
Microsoft 365· Nov 12, 2024
7.8High
CVE-2024-49030 (opens in a new tab)
Microsoft Excel Remote Code Execution Vulnerability
Microsoft 365· Nov 12, 2024
7.8High
CVE-2024-49029 (opens in a new tab)
Microsoft Excel Remote Code Execution Vulnerability
Microsoft 365· Nov 12, 2024
7.8High
CVE-2024-49028 (opens in a new tab)
Microsoft Excel Remote Code Execution Vulnerability
Microsoft 365· Nov 12, 2024
7.8High
CVE-2024-49027 (opens in a new tab)
Microsoft Excel Remote Code Execution Vulnerability
Microsoft 365· Nov 12, 2024
7.8High
CVE-2024-49026 (opens in a new tab)
Microsoft Excel Remote Code Execution Vulnerability
Microsoft 365· Nov 12, 2024
9.9Crit
CVE-2024-43602 (opens in a new tab)
Azure CycleCloud Remote Code Execution Vulnerability
Microsoft Azure· Nov 12, 2024

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 35 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.