CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 1 h ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 00%
High: 2,476100%
Medium: 00%
Low or not scored: 00%

Matching CVEs: 2,476; Last two years
Critical: 0; CVSS 9.0 and above
High: 2,476; CVSS 7.0 to 8.9
Known exploited: 16; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 399 · October 2026

Most CVEs

In each company's software, last two years

Matching CVEs

8.8High
CVE-2026-69722 (opens in a new tab)
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69716 (opens in a new tab)
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69686 (opens in a new tab)
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
7.7High
CVE-2026-69683 (opens in a new tab)
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69678 (opens in a new tab)
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69671 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69632 (opens in a new tab)
Use after free in Microsoft Office allows an unauthorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69629 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69614 (opens in a new tab)
Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69556 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69529 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
7.3High
CVE-2026-69477 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Access allows an authorized attacker to execute code locally.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69465 (opens in a new tab)
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69464 (opens in a new tab)
Execution with unnecessary privileges in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69442 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
8.1High
CVE-2026-69380 (opens in a new tab)
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Microsoft 365· Sep 8, 2026
7.5High
CVE-2026-69378 (opens in a new tab)
Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69355 (opens in a new tab)
External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69285 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69282 (opens in a new tab)
Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69273 (opens in a new tab)
Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69268 (opens in a new tab)
Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-65772 (opens in a new tab)
Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-62895 (opens in a new tab)
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
Microsoft Azure· Sep 8, 2026
7.8High
CVE-2026-62804 (opens in a new tab)
External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Sep 8, 2026
8.1High
CVE-2026-55007 (opens in a new tab)
Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
7.1High
CVE-2026-82076 (opens in a new tab)
An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submitting a specially crafted query causes the server to consume memory without bound during query planning, and the resulting exhaustion terminates the server process. This may result in a denial of service affecting all databases served by the affected node.
MongoDB Atlas· Sep 8, 2026
8.7High
CVE-2026-82075 (opens in a new tab)
An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources without any rate limiting, degrading or denying service to legitimate clients. No authentication, elevated privileges, or user interaction is required. Only availability is affected; data confidentiality and integrity are not impacted.
MongoDB Atlas· Sep 8, 2026
7.1High
CVE-2026-82074 (opens in a new tab)
MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually executed, resulting in unauthorized read access to collection data within the target database.
MongoDB Atlas· Sep 8, 2026
7.1High
CVE-2026-82073 (opens in a new tab)
A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an internal command parameter that can be set by external clients, causing a security check to be improperly skipped.
MongoDB Atlas· Sep 8, 2026
7.2High
CVE-2026-82071 (opens in a new tab)
Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary code execution.
MongoDB Atlas· Sep 8, 2026
7.1High
CVE-2026-82070 (opens in a new tab)
A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, but the diagnostic interface omits equivalent redaction. Successful exploitation requires a valid authenticated session with monitoring-level permissions and results in exposure of cleartext credentials that could enable impersonation of other users, including privileged accounts.
MongoDB Atlas· Sep 8, 2026
7.1High
CVE-2026-82068 (opens in a new tab)
A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on restart and potentially propagating to additional nodes in a sharded cluster. Manual intervention is required to restore service availability.
MongoDB Atlas· Sep 8, 2026
7.1High
CVE-2026-82065 (opens in a new tab)
A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits values that, once persisted to durable metadata, trigger a fatal assertion failure when the metadata is subsequently read by diagnostic operations. The corrupted metadata persists across server restarts and is replicated to other cluster members, requiring manual operator intervention to restore service.
MongoDB Atlas· Sep 8, 2026
8.7High
CVE-2026-82064 (opens in a new tab)
A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an assertion in its read concern processing logic that can be reached without authentication, and the assertion's assumptions about internal state do not hold for all member configurations, causing the server process to terminate.
MongoDB Atlas· Sep 8, 2026
7.0High
CVE-2026-82062 (opens in a new tab)
A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container operations that are disabled by default in production configurations, allowing direct storage-engine writes to arbitrary internal storage tables. The authorization check for these operations validates only the operation's namespace, not the actual storage target, enabling writes to unrelated internal met
MongoDB Atlas· Sep 8, 2026
7.2High
CVE-2026-82061 (opens in a new tab)
A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. No user interaction is required.
MongoDB Atlas· Sep 8, 2026
7.1High
CVE-2026-82058 (opens in a new tab)
A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error generation path performs unsafe numeric conversion on the user-controlled field name without proper exception handling, resulting in an uncaught exception that terminates the server process. This is possible because incoming wire protocol BSON validation does not enforce that array element field names are valid, in-range
MongoDB Atlas· Sep 8, 2026
7.1High
CVE-2026-82057 (opens in a new tab)
A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the storage engine layer. When documents were subsequently read from the misconfigured collection, the resulting mismatch in expected data format led to corrupted memory interpretation and a server crash. The crafted collection configuration persists across restarts, requiring manual operator intervention
MongoDB Atlas· Sep 8, 2026
7.1High
CVE-2026-82055 (opens in a new tab)
A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index, an inconsistency in geometry parsing can leave an internal object in an invalid, partially initialized state. During subsequent index key generation, access to this improperly initialized object results in a null pointer dereference that terminates the mongod process. An authenticated user with write access can use this to cause a denial of service.
MongoDB Atlas· Sep 8, 2026
7.1High
CVE-2026-82054 (opens in a new tab)
A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size, resulting in significant memory amplification. Under concurrent request load, the cumulative memory consumption can exhaust available heap memory, causing the server's out-of-memory handler to terminate the mongod process and deny service to all connected clients.
MongoDB Atlas· Sep 8, 2026
7.6High
CVE-2026-82053 (opens in a new tab)
A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the expected one. This can result in incorrect role assignments based on the LDAP directory's access control configuration, potentially allowing an authenticated user to acquire elevated privileges that were not intended by the deployment's authorization policy.
MongoDB Atlas· Sep 8, 2026
7.1High
CVE-2026-82052 (opens in a new tab)
The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod). Under certain specific conditions the regex match can start in the middle of a multi-code-unit character, triggering an assertion during query execution.
MongoDB Atlas· Sep 8, 2026
7.5High
CVE-2026-47625 (opens in a new tab)
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.
NVIDIA· Sep 8, 2026
7.5High
CVE-2026-16497 (opens in a new tab)
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause excessive iteration. A successful exploit of this vulnerability might lead to denial of service.
NVIDIA· Sep 8, 2026
8.1High
CVE-2026-86242 (opens in a new tab)
Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to Go's plugin.Open. After a successful open, optional Init runs immediately with the supplied config as the Bifrost process user. On documented dynamically linked builds (DYNAMIC=1 / no static-link flags), which the vendor requires for cust
JFrog· Sep 6, 2026
8.8High
CVE-2026-69857 (opens in a new tab)
Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network.
Microsoft Azure· Sep 3, 2026
8.1High
CVE-2026-82302 (opens in a new tab)
Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).
Elastic Cloud· Sep 3, 2026
8.1High
CVE-2026-78583 (opens in a new tab)
Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding Fleet management privileges could therefore cause every Elastic Agent on a targeted policy to receive a credential carrying arbitrarily elevated Elasticsearch cluster privileges, up to and including full cluster administration.
Elastic Cloud· Sep 3, 2026
8.2High
CVE-2026-84964 (opens in a new tab)
A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be released twice. An unauthenticated party acting as the trusted endpoint may cause the connecting client application to terminate unexpectedly.
MongoDB Atlas· Sep 3, 2026

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 1 h ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.