CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 1 h ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 00%
High: 00%
Medium: 2,002100%
Low or not scored: 00%

Matching CVEs: 2,002; Last two years
Critical: 0; CVSS 9.0 and above
High: 0; CVSS 7.0 to 8.9
Known exploited: 8; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 358 · October 2026

Most CVEs

In each company's software, last two years

Matching CVEs

6.5Med
CVE-2026-72648 (opens in a new tab)
Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in Elastic Cloud on Kubernetes (ECK) can lead to information disclosure via Retrieve Embedded Sensitive Data (CAPEC-37). When ECK reconciles a Fleet Server resource that authenticates to Elasticsearch with a service account token, the token is written into the generated workload specification in cleartext rather than being referenced from the Kubernetes Secret that ECK maintains for the other credentials on the same path. Any principal able to read workload specifications in the affected namespace can therefore rea
Elastic Cloud· Aug 13, 2026
6.5Med
CVE-2026-72647 (opens in a new tab)
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without a depth limit, exhausting the thread stack and terminating the affected node.
Elastic Cloud· Aug 13, 2026
6.5Med
CVE-2026-72645 (opens in a new tab)
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only read privileges on a single index can submit one small, specially crafted search request that causes an excessively large memory allocation, exhausting the JVM heap and terminating the affected node.
Elastic Cloud· Aug 13, 2026
6.5Med
CVE-2026-72640 (opens in a new tab)
The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each reference without validating that the reference is authorized for the resource being reconciled. A user whose Kubernetes permissions are limited to their own namespace can write that annotation, trigger a reconcile, and cause the operator to use its cluster-wide secret permissions to copy the contents of a secret from any other namespace into a secret the user can read.
Elastic Cloud· Aug 13, 2026
6.5Med
CVE-2026-72639 (opens in a new tab)
Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker. An authenticated user holding only read privileges on a single searchable index can submit one small search request that causes the node to reserve an excessively large internal data structure. The allocation occurs before the existing highlighting safety limits are evaluated, so memory exhaustion raises a fatal error that terminates the Elasticsearch node process. This results in a denial of se
Elastic Cloud· Aug 13, 2026
6.5Med
CVE-2026-72638 (opens in a new tab)
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that is resolved recursively without a cycle or depth check, exhausting the thread stack and terminating the affected node.
Elastic Cloud· Aug 13, 2026
6.5Med
CVE-2026-72636 (opens in a new tab)
Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of match operations performed. A search request containing a wildcard pattern with a large number of wildcard groups, evaluated against a sufficiently long name, exhausts the thread stack. Elasticsearch treats a stack overflow as an unrecoverable condition and shuts the node down, so the request terminat
Elastic Cloud· Aug 13, 2026
6.5Med
CVE-2026-72631 (opens in a new tab)
Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolled in the corresponding agent policy. The resulting key allows new documents to be inserted and index mappings to be extended for specific indices. The key does not allow reading, updating, or deleting existing documents
Elastic Cloud· Aug 13, 2026
6.5Med
CVE-2026-49089 (opens in a new tab)
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana process to spend an unbounded amount of time evaluating it. An authenticated user with read-only privileges was able to send a single request that left Kibana unable to serve any user until the process was restarted.
Elastic Cloud· Aug 13, 2026
6.5Med
CVE-2026-14298 (opens in a new tab)
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit decompressed content size and enforce the configured maximum file size in the Boards archive import handler, which allows an authenticated user to cause memory exhaustion or unbounded disk consumption via a crafted .boardarchive file uploaded to the import endpoint.. Mattermost Advisory ID: MMSA-2026-00713
Mattermost Cloud· Aug 13, 2026
5.9Med
CVE-2026-0299 (opens in a new tab)
Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges. The GlobalProtect app on iOS, Android, and Chrome OS is not affected.
Palo Alto Networks· Aug 13, 2026
5.2Med
CVE-2026-0298 (opens in a new tab)
An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle (MitM) attacker to execute arbitrary code with SYSTEM privileges on an affected client. The GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS is not affected.
Palo Alto Networks· Aug 13, 2026
5.2Med
CVE-2026-0297 (opens in a new tab)
A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man-in-the-middle (MitM) attacker or a rogue gateway to disrupt system processes and potentially execute arbitrary code with elevated privileges (SYSTEM privileges on Windows, and root privileges on macOS and Linux).
Palo Alto Networks· Aug 13, 2026
4.5Med
CVE-2026-0296 (opens in a new tab)
Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle (MitM) access to intercept and modify application communications. VPN tunnel traffic is not impacted. The GlobalProtect app on iOS, Android, and Chrome OS is not affected.
Palo Alto Networks· Aug 13, 2026
4.1Med
CVE-2026-0295 (opens in a new tab)
A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root. The GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected.
Palo Alto Networks· Aug 13, 2026
6.0Med
CVE-2026-0294 (opens in a new tab)
A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma® Access Agent app on Windows and macOS devices enables a local user to execute code with elevated privileges. The Prisma Access Agent on Linux, iOS, Android, and ChromeOS is not affected.
Palo Alto Networks· Aug 13, 2026
5.6Med
CVE-2026-0293 (opens in a new tab)
A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files. The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.
Palo Alto Networks· Aug 13, 2026
6.3Med
CVE-2026-19503 (opens in a new tab)
MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.
MongoDB Atlas· Aug 12, 2026
6.8Med
CVE-2026-19502 (opens in a new tab)
MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values.
MongoDB Atlas· Aug 12, 2026
4.3Med
CVE-2026-6821 (opens in a new tab)
GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a private project due to missing authorization checks in a merge requests API endpoint.
GitLab· Aug 12, 2026
4.3Med
CVE-2026-4879 (opens in a new tab)
GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to higher-privileged roles due to missing authorization on a merge request API endpoint.
GitLab· Aug 12, 2026
6.0Med
CVE-2026-19643 (opens in a new tab)
An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version 1.11.862.
Amazon Web Services· Aug 12, 2026
6.0Med
CVE-2026-19642 (opens in a new tab)
An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memory corruption in an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version 1.11.862.
Amazon Web Services· Aug 12, 2026
4.3Med
CVE-2026-18433 (opens in a new tab)
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect authorization checks in a GraphQL query.
GitLab· Aug 12, 2026
4.3Med
CVE-2026-8667 (opens in a new tab)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required maintainer-level permissions due to improper authorization checks.
GitLab· Aug 12, 2026
4.3Med
CVE-2026-18244 (opens in a new tab)
GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group settings page.
GitLab· Aug 12, 2026
4.3Med
CVE-2026-70547 (opens in a new tab)
An authenticated user without repository read permission may access package metadata under specific conditions.
JFrog· Aug 12, 2026
5.9Med
CVE-2026-69107 (opens in a new tab)
An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.
JFrog· Aug 12, 2026
6.5Med
CVE-2026-68758 (opens in a new tab)
A low-privileged authenticated user may access restricted support information under specific conditions.
JFrog· Aug 12, 2026
5.3Med
CVE-2026-66384 (opens in a new tab)Known exploited
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
JFrog· Aug 12, 2026
6.7Med
CVE-2026-66016 (opens in a new tab)
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.
JFrog· Aug 12, 2026
5.3Med
CVE-2026-68760 (opens in a new tab)
An unauthenticated user may bypass authentication under specific cache conditions.
JFrog· Aug 12, 2026
6.6Med
CVE-2026-68756 (opens in a new tab)
A party with write access to stored session data may affect JFrog Artifactory under specific conditions.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-68755 (opens in a new tab)
A bundle writer may create misleading release promotion information under specific conditions.
JFrog· Aug 12, 2026
6.5Med
CVE-2026-68754 (opens in a new tab)
A repository publisher without delete permission may modify protected package content under specific conditions.
JFrog· Aug 12, 2026
5.3Med
CVE-2026-68753 (opens in a new tab)
An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-66382 (opens in a new tab)
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
JFrog· Aug 12, 2026
5.3Med
CVE-2026-66381 (opens in a new tab)
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-66380 (opens in a new tab)
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-66379 (opens in a new tab)
An authenticated user may view private Puppet module metadata without repository read access.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-66378 (opens in a new tab)
An authenticated user without repository read permission may access private NuGet metadata under specific conditions.
JFrog· Aug 12, 2026
5.3Med
CVE-2026-66377 (opens in a new tab)
An unauthenticated user may access restricted repository information under specific conditions.
JFrog· Aug 12, 2026
5.4Med
CVE-2026-66376 (opens in a new tab)
Credentials for a deleted user may remain valid for a short period under specific conditions.
JFrog· Aug 12, 2026
5.7Med
CVE-2026-18171 (opens in a new tab)
Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged code inside the sandbox can derive that path and write to a host directory the operator attached read-only.
Docker· Aug 12, 2026
5.5Med
CVE-2026-14479 (opens in a new tab)
A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerability to cause the NT AUTHORITY\SYSTEM service to terminate unexpectedly, resulting in a denial-of-service condition.
Autodesk· Aug 12, 2026
5.9Med
CVE-2026-18709 (opens in a new tab)
An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees.
MongoDB Atlas· Aug 11, 2026
5.3Med
CVE-2026-18708 (opens in a new tab)
An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could result in corruption of query results affecting other users and denial of service targeted at their operations on the same database. Impact is limited to the scripting engine's execution sandbox, which does not provide access to database, filesystem, or network resources.
MongoDB Atlas· Aug 11, 2026
5.3Med
CVE-2026-18707 (opens in a new tab)
An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service.
MongoDB Atlas· Aug 11, 2026
5.3Med
CVE-2026-18702 (opens in a new tab)
An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring unauthorized activity, or degrade operational monitoring by causing excessive log volume.
MongoDB Atlas· Aug 11, 2026
6.0Med
CVE-2026-18700 (opens in a new tab)
An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result in a server crash, leading to a denial of service.
MongoDB Atlas· Aug 11, 2026

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 1 h ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.