CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 36 min ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 00%
High: 00%
Medium: 2,002100%
Low or not scored: 00%

Matching CVEs: 2,002; Last two years
Critical: 0; CVSS 9.0 and above
High: 0; CVSS 7.0 to 8.9
Known exploited: 8; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 358 · October 2026

Most CVEs

In each company's software, last two years

Matching CVEs

6.5Med
CVE-2026-80073 (opens in a new tab)
Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-78522 (opens in a new tab)
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-78520 (opens in a new tab)
Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-78515 (opens in a new tab)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
5.5Med
CVE-2026-78513 (opens in a new tab)
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
Microsoft 365· Sep 8, 2026
5.5Med
CVE-2026-78506 (opens in a new tab)
Improper null termination in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-78503 (opens in a new tab)
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-78502 (opens in a new tab)
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-77911 (opens in a new tab)
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-77909 (opens in a new tab)
Insufficiently protected credentials in Azure CycleCloud allows an authorized attacker to disclose information over a network.
Microsoft Azure· Sep 8, 2026
6.5Med
CVE-2026-72977 (opens in a new tab)
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
5.0Med
CVE-2026-72976 (opens in a new tab)
Out-of-bounds read in Microsoft Office Word allows an authorized attacker to disclose information locally.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-72975 (opens in a new tab)
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-72974 (opens in a new tab)
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-72956 (opens in a new tab)
Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-72938 (opens in a new tab)
Access of resource using incompatible type ('type confusion') in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-69734 (opens in a new tab)
Integer overflow or wraparound in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-69719 (opens in a new tab)
Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
5.4Med
CVE-2026-69690 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-69636 (opens in a new tab)
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-69626 (opens in a new tab)
Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
4.8Med
CVE-2026-69615 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Sep 8, 2026
6.3Med
CVE-2026-69559 (opens in a new tab)
Origin validation error in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
5.4Med
CVE-2026-69417 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-69409 (opens in a new tab)
Execution with unnecessary privileges in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
5.4Med
CVE-2026-69402 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Sep 8, 2026
5.9Med
CVE-2026-69382 (opens in a new tab)
Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-69375 (opens in a new tab)
Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-69361 (opens in a new tab)
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Sep 8, 2026
6.8Med
CVE-2026-65812 (opens in a new tab)
Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-64918 (opens in a new tab)
Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network.
Microsoft 365· Sep 8, 2026
5.1Med
CVE-2026-82069 (opens in a new tab)
A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypassed when processing search queries through the sharded cluster router. This results in sensitive query literals being stored and made accessible through the query statistics interface.
MongoDB Atlas· Sep 8, 2026
5.3Med
CVE-2026-82066 (opens in a new tab)
A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. The revealed memory contents may be partially observable through diagnostic query statistics output.
MongoDB Atlas· Sep 8, 2026
6.0Med
CVE-2026-82063 (opens in a new tab)
A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific timing conditions during cursor operations, a stale pointer to a freed resource may be retained and subsequently dereferenced during cursor cleanup, leading to a server process crash.
MongoDB Atlas· Sep 8, 2026
6.0Med
CVE-2026-82059 (opens in a new tab)
An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges could trigger an assertion failure in the index key generation code path. In certain build configurations, this assertion failure results in termination of the mongod process, causing a denial of service to all connected clients.
MongoDB Atlas· Sep 8, 2026
6.0Med
CVE-2026-82056 (opens in a new tab)
A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been freed, leading to a server crash. An authenticated user with readWrite privileges can trigger this condition through specific concurrent text-search and index management operations, resulting in denial of service for all connected clients. This
MongoDB Atlas· Sep 8, 2026
6.5Med
CVE-2026-82299 (opens in a new tab)
Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).
Elastic Cloud· Sep 3, 2026
4.3Med
CVE-2026-82298 (opens in a new tab)
Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).
Elastic Cloud· Sep 3, 2026
4.3Med
CVE-2026-78596 (opens in a new tab)
Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data via Privilege Abuse (CAPEC-122). An authenticated user holding Security read-level access in a single Kibana space could trigger Entity Analytics migration operations that perform privileged writes across all Kibana spaces, regardless of that user's actual access scope.
Elastic Cloud· Sep 3, 2026
4.3Med
CVE-2026-78595 (opens in a new tab)
Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent metadata and access diagnostic content belonging to agents enrolled in other Kibana spaces.
Elastic Cloud· Sep 3, 2026
4.3Med
CVE-2026-78593 (opens in a new tab)
An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond the caller's authorized Elasticsearch permissions.
Elastic Cloud· Sep 3, 2026
6.9Med
CVE-2026-84968 (opens in a new tab)
An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a small amount of adjacent process memory copied into an error message that is returned to application code. This may result in unintended disclosure of limited memory contents.
MongoDB Atlas· Sep 3, 2026
5.1Med
CVE-2026-84967 (opens in a new tab)
A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension's shell feature, can place characters of the unauthorized-user’s choosing into that command line. No privileges on the developer's machine are required, but several user actions are. The confirmation the developer sees does not displ
MongoDB Atlas· Sep 3, 2026
5.9Med
CVE-2026-84966 (opens in a new tab)
An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the library may read memory outside the intended buffer and terminate the calling process. No authentication is required, but the calling application must pass the oversized name in a specific form.
MongoDB Atlas· Sep 3, 2026
5.9Med
CVE-2026-84965 (opens in a new tab)
An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently large JSON input to an application that links the library may cause that application to terminate unexpectedly, resulting in denial of service.
MongoDB Atlas· Sep 3, 2026
6.3Med
CVE-2026-84963 (opens in a new tab)
An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticated party who can supply the input processed by an application that uses this component may cause that application to hold data that does not match what was submitted, which may result in unintended alteration of data.
MongoDB Atlas· Sep 3, 2026
5.7Med
CVE-2026-84962 (opens in a new tab)
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.
MongoDB Atlas· Sep 3, 2026
5.9Med
CVE-2026-84970 (opens in a new tab)
A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can cause the library to read memory beyond the supplied buffer and return it to the caller, to silently accept only part of the input as a complete document, or to terminate the process. No MongoDB server, credentials, or non-default configuration is required; the effect is confined to the process that uses the library.
MongoDB Atlas· Sep 3, 2026
6.3Med
CVE-2026-84969 (opens in a new tab)
A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no privileges on the application that links the driver, may cause a small amount of data outside the intended buffer to be altered.
MongoDB Atlas· Sep 3, 2026
6.5Med
CVE-2026-19475 (opens in a new tab)
An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected.
Grafana Cloud· Sep 2, 2026

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 36 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.