CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 25 min ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 00%
High: 00%
Medium: 2,002100%
Low or not scored: 00%

Matching CVEs: 2,002; Last two years
Critical: 0; CVSS 9.0 and above
High: 0; CVSS 7.0 to 8.9
Known exploited: 8; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 358 · October 2026

Most CVEs

In each company's software, last two years

Matching CVEs

4.3Med
CVE-2026-14344 (opens in a new tab)
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce the board-creation permission which allows an unauthorized authenticated user to create boards via the board duplicate, boards-and-blocks, and archive-import endpoints.. Mattermost Advisory ID: MMSA-2026-00715
Mattermost Cloud· Sep 14, 2026
4.3Med
CVE-2026-14259 (opens in a new tab)
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board creation permissions when importing archive files which allows an authenticated non-guest team member to create Open or Private boards despite administrator restrictions via importing a crafted .boardarchive file. Mattermost Advisory ID: MMSA-2026-00712
Mattermost Cloud· Sep 14, 2026
4.3Med
CVE-2026-13417 (opens in a new tab)
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate the type of `fields.properties` on block creation which allows an authenticated user with editor access to a board to crash the Boards plugin worker and trigger a denial of service via a child block whose `fields.properties` is a non-object value. Mattermost Advisory ID: MMSA-2026-00710
Mattermost Cloud· Sep 14, 2026
4.3Med
CVE-2026-12882 (opens in a new tab)
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown autolinks with unmatched trailing closing parentheses in linear time, which allows an authenticated user with permission to create posts to cause excessive server CPU consumption and degrade availability for other users via specially crafted post or message attachment content. Mattermost Advisory ID: MMSA-2026-00703
Mattermost Cloud· Sep 14, 2026
4.3Med
CVE-2026-11993 (opens in a new tab)
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce the limit of concurrent files being processed and handled failed files, which allows a user with permission to upload files to spawn more goroutines than intended and block the indexing of other files via uploading heavy files constantly to the server.. Mattermost Advisory ID: MMSA-2026-00696
Mattermost Cloud· Sep 14, 2026
5.3Med
CVE-2026-10556 (opens in a new tab)
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service to all users on the instance via a crafted {{POST}} request to the public webhook endpoint.. Mattermost Advisory ID: MMSA-2026-00693
Mattermost Cloud· Sep 14, 2026
4.3Med
CVE-2026-10542 (opens in a new tab)
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel action ownership which allows channel managers to update actions in other channels via the channel action update endpoint.. Mattermost Advisory ID: MMSA-2026-00692
Mattermost Cloud· Sep 14, 2026
6.7Med
CVE-2026-89332 (opens in a new tab)
Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the workspace settings file, which redirects the Kiro Powers registry request to an actor controlled endpoint and sends workspace data to that endpoint when the Powers panel is opened. To remediate this issue, users should upgrade to Kiro IDE version 0.8.135 or later. Users who opened a project in an earlier
Amazon Web Services· Sep 11, 2026
6.1Med
CVE-2026-88036 (opens in a new tab)
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.
MongoDB Atlas· Sep 10, 2026
5.7Med
CVE-2026-88035 (opens in a new tab)
A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to terminate unexpectedly. Reaching this code requires a build in which the optional external SASL authentication backend is present and a connection configured to use it.
MongoDB Atlas· Sep 10, 2026
6.1Med
CVE-2026-88034 (opens in a new tab)
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C++ Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.
MongoDB Atlas· Sep 10, 2026
6.1Med
CVE-2026-88033 (opens in a new tab)
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.
MongoDB Atlas· Sep 10, 2026
5.4Med
CVE-2026-87107 (opens in a new tab)
Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog objects. A caller with {{service:write}} or {{node:write}} permission may exploit this issue to remove services, checks, or nodes imported from a peered cluster without holding authority over the peer origin. This vulnerability (CVE-2026-87107) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
HashiCorp (HCP / Terraform Cloud)· Sep 10, 2026
6.5Med
CVE-2026-87106 (opens in a new tab)
Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL authorization is evaluated. A client that can complete the internal RPC mTLS handshake may exploit this issue without holding a valid ACL token. This vulnerability (CVE-2026-87106) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.
HashiCorp (HCP / Terraform Cloud)· Sep 10, 2026
6.1Med
CVE-2026-88031 (opens in a new tab)
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.
MongoDB Atlas· Sep 10, 2026
6.1Med
CVE-2026-88030 (opens in a new tab)
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.
MongoDB Atlas· Sep 10, 2026
6.1Med
CVE-2026-88029 (opens in a new tab)
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.
MongoDB Atlas· Sep 10, 2026
6.1Med
CVE-2026-88025 (opens in a new tab)
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.
MongoDB Atlas· Sep 10, 2026
6.1Med
CVE-2026-88024 (opens in a new tab)
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable.
MongoDB Atlas· Sep 10, 2026
6.1Med
CVE-2026-88023 (opens in a new tab)
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target.
MongoDB Atlas· Sep 10, 2026
4.8Med
CVE-2026-0304 (opens in a new tab)
A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle (MitM) access to execute code with root privileges on the Broker VM.
Palo Alto Networks· Sep 10, 2026
4.0Med
CVE-2026-0309 (opens in a new tab)
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI and the device must be configured with a Luna Hardware Security Module (HSM). The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.
Palo Alto Networks· Sep 10, 2026
5.9Med
CVE-2026-0307 (opens in a new tab)
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges. This GlobalProtect app on iOS, Android and ChromeOS is not impacted.
Palo Alto Networks· Sep 10, 2026
5.8Med
CVE-2026-0306 (opens in a new tab)
A vulnerability in the EndPoint Data Loss Prevention (DLP) enforcement of Palo Alto Networks Prisma® Access Agent enables a local user to bypass configured DLP policy enforcement controls and exfiltrate sensitive data. This Prisma Access Agent on macOS, Linux, iOS, Android and Chrome OS is not affected.
Palo Alto Networks· Sep 10, 2026
4.3Med
CVE-2026-0305 (opens in a new tab)
An information disclosure vulnerability in the Palo Alto Networks Prisma® Access Agent on Linux enables a local user to access sensitive configuration data and credentials. The Prisma Access Agent on macOS, Windows, iOS, Android and Chrome OS is not affected.
Palo Alto Networks· Sep 10, 2026
5.5Med
CVE-2026-85875 (opens in a new tab)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft 365· Sep 8, 2026
5.5Med
CVE-2026-83951 (opens in a new tab)
Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
Microsoft 365· Sep 8, 2026
5.5Med
CVE-2026-83949 (opens in a new tab)
Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
Microsoft 365· Sep 8, 2026
5.5Med
CVE-2026-81958 (opens in a new tab)
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft 365· Sep 8, 2026
5.5Med
CVE-2026-81401 (opens in a new tab)
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft 365· Sep 8, 2026
5.5Med
CVE-2026-81400 (opens in a new tab)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft 365· Sep 8, 2026
5.5Med
CVE-2026-81399 (opens in a new tab)
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft 365· Sep 8, 2026
5.5Med
CVE-2026-81395 (opens in a new tab)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft 365· Sep 8, 2026
5.5Med
CVE-2026-81394 (opens in a new tab)
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft 365· Sep 8, 2026
5.5Med
CVE-2026-81393 (opens in a new tab)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft 365· Sep 8, 2026
5.5Med
CVE-2026-81392 (opens in a new tab)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft 365· Sep 8, 2026
5.5Med
CVE-2026-81391 (opens in a new tab)
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft 365· Sep 8, 2026
5.5Med
CVE-2026-81390 (opens in a new tab)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft 365· Sep 8, 2026
5.5Med
CVE-2026-81387 (opens in a new tab)
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-80091 (opens in a new tab)
Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-80090 (opens in a new tab)
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-80089 (opens in a new tab)
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-80088 (opens in a new tab)
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-80087 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-80086 (opens in a new tab)
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-80084 (opens in a new tab)
Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-80082 (opens in a new tab)
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-80079 (opens in a new tab)
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-80078 (opens in a new tab)
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-80076 (opens in a new tab)
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 25 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.