CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 12 min ago

Severity mix

CVSS base severity, as scored in NVD

Critical: 4018%
High: 2,47348%
Medium: 1,99639%
Low or not scored: 2365%

CVEs: 5,106; Last two years
Critical: 401; CVSS 9.0 and above
High: 2,473; CVSS 7.0 to 8.9
Known exploited: 55; On CISA's KEV list

CVEs published

By month, last two years

Peak 834 · October 2026

Most CVEs

In each company's software, last two years

Latest CVEs

8.8High
CVE-2026-86919 (opens in a new tab)
A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An attacker with a paired Bluetooth device may be able to execute arbitrary code.
Apple (iCloud, App Store and services)· Oct 20, 2026
4.3Med
CVE-2026-86918 (opens in a new tab)
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected app termination.
Apple (iCloud, App Store and services)· Oct 20, 2026
5.5Med
CVE-2026-86914 (opens in a new tab)
An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive network connection information.
Apple (iCloud, App Store and services)· Oct 20, 2026
5.4Med
CVE-2026-86913 (opens in a new tab)
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory.
Apple (iCloud, App Store and services)· Oct 20, 2026
4.4Med
CVE-2026-86907 (opens in a new tab)
An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app with admin privileges may be able to modify the System Keychain.
Apple (iCloud, App Store and services)· Oct 20, 2026
5.4Med
CVE-2026-86872 (opens in a new tab)
A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to unexpected behavior.
Apple (iCloud, App Store and services)· Oct 20, 2026
5.9Med
CVE-2026-86871 (opens in a new tab)
An integer underflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network file server may be able to cause unexpected system termination.
Apple (iCloud, App Store and services)· Oct 20, 2026
9.1Crit
CVE-2026-86868 (opens in a new tab)
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker may be able to impersonate other users.
Apple (iCloud, App Store and services)· Oct 20, 2026
6.5Med
CVE-2026-84613 (opens in a new tab)
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An attacker in radio range may be able to cause unexpected system termination.
Apple (iCloud, App Store and services)· Oct 20, 2026
5.5Med
CVE-2026-84582 (opens in a new tab)
A privacy issue was addressed with improved access restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.
Apple (iCloud, App Store and services)· Oct 20, 2026
8.8High
CVE-2026-84579 (opens in a new tab)
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Opening a file referencing a network share may lead to unexpected software execution.
Apple (iCloud, App Store and services)· Oct 20, 2026
3.5Low
CVE-2026-84547 (opens in a new tab)
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in physical proximity may be able to corrupt process memory.
Apple (iCloud, App Store and services)· Oct 20, 2026
5.5Med
CVE-2026-84508 (opens in a new tab)
This issue was addressed with improved validation of the caller's access. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, visionOS 27. An app may be able to access protected user data.
Apple (iCloud, App Store and services)· Oct 20, 2026
2.0Low
CVE-2026-84490 (opens in a new tab)
This issue was addressed through improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker with physical access to a locked device may be able to bypass Digital ID authentication when iPhone Mirroring is active.
Apple (iCloud, App Store and services)· Oct 20, 2026
5.5Med
CVE-2026-65396 (opens in a new tab)
A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination.
Apple (iCloud, App Store and services)· Oct 20, 2026
5.5Med
CVE-2026-65379 (opens in a new tab)
The issue was addressed with improved handling of secure input state. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.
Apple (iCloud, App Store and services)· Oct 20, 2026
4.7Med
CVE-2026-65372 (opens in a new tab)
A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious application may be able to bypass Privacy preferences.
Apple (iCloud, App Store and services)· Oct 20, 2026
5.5Med
CVE-2026-65356 (opens in a new tab)
An access issue was addressed with improved access controls. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.
Apple (iCloud, App Store and services)· Oct 20, 2026
7.8High
CVE-2026-28853 (opens in a new tab)
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate privileges.
Apple (iCloud, App Store and services)· Oct 20, 2026
5.5Med
CVE-2026-28850 (opens in a new tab)
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.8, visionOS 27. An app may be able to access sensitive user data.
Apple (iCloud, App Store and services)· Oct 20, 2026
6.3Med
CVE-2026-105298 (opens in a new tab)
Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filters, cache keys, and logs that read the request URI (session.req_header().uri) saw the :authority value, but the upstream received the client-supplied Host value. Pingora also accepted :authority values containing userinfo (for example, user@example.com). This violates RFC 9113 Section 8.3.1, which requires an intermediary to use the :authority value for Host and replace any existing Host field. Root cause * HTTP/2 to HTTP/1.1: Host was generated from :author
Cloudflare· Oct 20, 2026
7.5High
CVE-2026-105297 (opens in a new tab)
Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on concurrent streams. A remote, unauthenticated client can send 1-byte HPACK references to a near-empty header, making the server allocate hundreds of thousands of header fields per stream across an unlimited number of streams on one connection, and use HTTP/2 flow control to keep those streams open. This can exhaust memory and degrade or terminate the Pingora process. Impact Remote, unauthenticated denial of service against a
Cloudflare· Oct 20, 2026
8.2High
CVE-2026-112368 (opens in a new tab)
An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.
MongoDB Atlas· Oct 19, 2026
6.5Med
CVE-2026-19621 (opens in a new tab)
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion web socket events and returning thread API responses, which allows an authenticated channel member to obtain server-side webhook URLs and authentication context from interactive-message posts via the post_deleted websocket event or the threads REST API.. Mattermost Advisory ID: MMSA-2026-00766
Mattermost Cloud· Oct 16, 2026
4.9Med
CVE-2026-19600 (opens in a new tab)
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate authenticated users via the debug-level Mattermost server log.. Mattermost Advisory ID: MMSA-2026-00763
Mattermost Cloud· Oct 16, 2026
4.9Med
CVE-2026-19076 (opens in a new tab)
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switch endpoint, which allows an attacker with a valid OAuth bearer token for a target user to permanently take over that user's SSO-backed account by setting an attacker-controlled password and detaching the account from its identity provider via a crafted request to POST /api/v4/users/login/switch.. Mattermost Advisory ID: MMSA-2026-00758
Mattermost Cloud· Oct 16, 2026
4.3Med
CVE-2026-18799 (opens in a new tab)
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administrator-initiated imports which allows an authenticated attacker with team admin privileges to force-add existing Mattermost users to their team and forge posts attributed to those users' identities via a crafted Slack export containing target users' email addresses.. Mattermost Advisory ID: MMSA-2026-00757
Mattermost Cloud· Oct 16, 2026
4.3Med
CVE-2026-18560 (opens in a new tab)
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advisory ID: MMSA-2026-00754
Mattermost Cloud· Oct 16, 2026
4.3Med
CVE-2026-18256 (opens in a new tab)
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private teams to disclose the ID, name, and display name of private teams via a modified team search request. Mattermost Advisory ID: MMSA-2026-00748
Mattermost Cloud· Oct 16, 2026
5.0Med
CVE-2026-18223 (opens in a new tab)
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team and guest invitation tokens, which allows an authenticated attacker to join a team or gain unauthorized access to private channels via a forwarded or leaked invitation link.. Mattermost Advisory ID: MMSA-2026-00747
Mattermost Cloud· Oct 16, 2026
7.1High
CVE-2026-16453 (opens in a new tab)
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the RelayState.. Mattermost Advisory ID: MMSA-2026-00727
Mattermost Cloud· Oct 16, 2026
6.5Med
CVE-2026-16251 (opens in a new tab)
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized image response.. Mattermost Advisory ID: MMSA-2026-00726
Mattermost Cloud· Oct 16, 2026
4.3Med
CVE-2026-19867 (opens in a new tab)
Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user to degrade post-processing latency and consume excessive CPU on behalf of other members of any channel they share via storing an oversized notify_props.mention_keys list on their own profile.. Mattermost Advisory ID: MMSA-2026-00773
Mattermost Cloud· Oct 16, 2026
4.3Med
CVE-2026-19603 (opens in a new tab)
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the status endpoints, without being a member of that channel. Mattermost Advisory ID: MMSA-2026-00765
Mattermost Cloud· Oct 16, 2026
4.9Med
CVE-2026-19601 (opens in a new tab)
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed, which allows a System Console administrator to disclose the plaintext bind password to an attacker-controlled server via the Test Connection / diagnostics feature. Mattermost Advisory ID: MMSA-2026-00764
Mattermost Cloud· Oct 16, 2026
6.5Med
CVE-2026-19541 (opens in a new tab)
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the token URL at an attacker-controlled endpoint and triggering validation.. Mattermost Advisory ID: MMSA-2026-00761
Mattermost Cloud· Oct 16, 2026
6.4Med
CVE-2026-18795 (opens in a new tab)
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756
Mattermost Cloud· Oct 16, 2026
6.5Med
CVE-2026-18551 (opens in a new tab)
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or channel admin via a crafted PUT request to the member roles API endpoint.. Mattermost Advisory ID: MMSA-2026-00752
Mattermost Cloud· Oct 16, 2026
6.5Med
CVE-2026-108455 (opens in a new tab)
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Oct 15, 2026
6.5Med
CVE-2026-108454 (opens in a new tab)
Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Oct 15, 2026
6.5Med
CVE-2026-108453 (opens in a new tab)
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108452 (opens in a new tab)
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108451 (opens in a new tab)
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108450 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108449 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
7.5High
CVE-2026-108448 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108447 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108446 (opens in a new tab)
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108445 (opens in a new tab)
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108444 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 12 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.