CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 18 min ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 00%
High: 00%
Medium: 2,002100%
Low or not scored: 00%

Matching CVEs: 2,002; Last two years
Critical: 0; CVSS 9.0 and above
High: 0; CVSS 7.0 to 8.9
Known exploited: 8; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 358 · October 2026

Most CVEs

In each company's software, last two years

Matching CVEs

6.3Med
CVE-2026-24226 (opens in a new tab)
NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause improper control of code generation. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
NVIDIA· Jul 14, 2026
6.4Med
CVE-2026-24220 (opens in a new tab)
NVIDIA TensorRT-LLM for any platform contains a vulnerability in visual gen server, where an attacker could cause an unsafe deserialization by unauthorized zeroMQ deserialization. A successful exploit of this vulnerability might lead to code execution.
NVIDIA· Jul 14, 2026
6.5Med
CVE-2026-47481 (opens in a new tab)
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an authentication bypass through an alternative path or channel. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
NVIDIA· Jul 14, 2026
5.5Med
CVE-2026-56195 (opens in a new tab)
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
Microsoft 365· Jul 14, 2026
5.5Med
CVE-2026-56192 (opens in a new tab)
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
Microsoft 365· Jul 14, 2026
5.4Med
CVE-2026-56157 (opens in a new tab)
Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Jul 14, 2026
5.5Med
CVE-2026-55142 (opens in a new tab)
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
Microsoft 365· Jul 14, 2026
5.5Med
CVE-2026-55138 (opens in a new tab)
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft 365· Jul 14, 2026
5.4Med
CVE-2026-55135 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Jul 14, 2026
5.4Med
CVE-2026-55126 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Jul 14, 2026
5.5Med
CVE-2026-55124 (opens in a new tab)
Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
Microsoft 365· Jul 14, 2026
5.5Med
CVE-2026-55121 (opens in a new tab)
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
Microsoft 365· Jul 14, 2026
5.5Med
CVE-2026-55057 (opens in a new tab)
Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally.
Microsoft 365· Jul 14, 2026
6.5Med
CVE-2026-55054 (opens in a new tab)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Jul 14, 2026
6.5Med
CVE-2026-55051 (opens in a new tab)
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
Microsoft 365· Jul 14, 2026
5.5Med
CVE-2026-55050 (opens in a new tab)
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
Microsoft 365· Jul 14, 2026
5.5Med
CVE-2026-55047 (opens in a new tab)
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
Microsoft 365· Jul 14, 2026
5.5Med
CVE-2026-55046 (opens in a new tab)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft 365· Jul 14, 2026
5.5Med
CVE-2026-55042 (opens in a new tab)
Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.
Microsoft 365· Jul 14, 2026
5.4Med
CVE-2026-55030 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Jul 14, 2026
5.5Med
CVE-2026-55028 (opens in a new tab)
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
Microsoft 365· Jul 14, 2026
5.5Med
CVE-2026-55027 (opens in a new tab)
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
Microsoft 365· Jul 14, 2026
5.5Med
CVE-2026-55026 (opens in a new tab)
Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally.
Microsoft 365· Jul 14, 2026
5.5Med
CVE-2026-55023 (opens in a new tab)
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
Microsoft 365· Jul 14, 2026
5.4Med
CVE-2026-55020 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Jul 14, 2026
5.4Med
CVE-2026-55019 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Jul 14, 2026
5.4Med
CVE-2026-55016 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Jul 14, 2026
5.5Med
CVE-2026-50408 (opens in a new tab)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft 365· Jul 14, 2026
5.5Med
CVE-2026-48580 (opens in a new tab)
Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft 365· Jul 14, 2026
5.4Med
CVE-2026-58647 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Power BI allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Jul 14, 2026
6.5Med
CVE-2026-58279 (opens in a new tab)
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
Microsoft Azure· Jul 14, 2026
6.1Med
CVE-2026-54988 (opens in a new tab)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft 365· Jul 14, 2026
6.5Med
CVE-2026-54108 (opens in a new tab)
External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Jul 14, 2026
5.5Med
CVE-2026-15682 (opens in a new tab)
AnyDesk Support Information Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Send Support Information feature. By creating a junction, an attacker can abuse the service to create arbitrary files. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-2664
AnyDesk· Jul 13, 2026
5.5Med
CVE-2026-15681 (opens in a new tab)
AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of screen recording files. By creating a junction, an attacker can abuse the service to create arbitrary files. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-26591
AnyDesk· Jul 13, 2026
4.3Med
CVE-2026-9824 (opens in a new tab)
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to check the manage_shared_channels permission in the /share-channel autocomplete handler, which allows an authenticated user without that permission to enumerate configured remote cluster connection metadata via slash command autocomplete.. Mattermost Advisory ID: MMSA-2026-00676
Mattermost Cloud· Jul 13, 2026
4.3Med
CVE-2026-6541 (opens in a new tab)
Mattermost versions 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict metric configuration changes to the playbook being saved, which allows an authenticated user with team access to alter another user’s playbook metric settings via a crafted import or update request with a foreign metric ID. Mattermost Advisory ID: MMSA-2026-00653
Mattermost Cloud· Jul 13, 2026
4.9Med
CVE-2026-9708 (opens in a new tab)
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate that an assigned incoming webhook user has access to the target team or channel, which allows a requester with webhook management permissions to create posts or direct messages attributed to another user via crafted incoming webhook configuration and payloads.. Mattermost Advisory ID: MMSA-2026-00683
Mattermost Cloud· Jul 13, 2026
5.4Med
CVE-2026-9597 (opens in a new tab)
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4 fail to verify whether a guest account is deactivated before creating a session in the magic-link token login path, which allows a deactivated guest user to obtain a fully functional session via a magic-link token issued prior to deactivation.. Mattermost Advisory ID: MMSA-2026-00681
Mattermost Cloud· Jul 13, 2026
6.5Med
CVE-2026-9571 (opens in a new tab)
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh tokens upon user account deactivation, which allows a deactivated user or an attacker in possession of a valid refresh token to obtain new functional access tokens via the OAuth refresh token grant endpoint.. Mattermost Advisory ID: MMSA-2026-00680
Mattermost Cloud· Jul 13, 2026
6.5Med
CVE-2026-6850 (opens in a new tab)
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate the length and content of message attachment field values, which allows an authenticated attacker to cause a denial of service for all users in a channel via a post containing a specially crafted payload that triggers catastrophic backtracking in the client-side markdown parser.. Mattermost Advisory ID: MMSA-2026-00658
Mattermost Cloud· Jul 13, 2026
6.5Med
CVE-2026-10106 (opens in a new tab)
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify that the channel referenced in an action cookie matches the channel of the target post, which allows an authenticated user without access to a private channel to trigger interactive post actions on posts in that channel via a cookie obtained from any accessible channel.. Mattermost Advisory ID: MMSA-2026-00690
Mattermost Cloud· Jul 13, 2026
4.3Med
CVE-2026-10103 (opens in a new tab)
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing arbitrary post IDs in channels shared with that remote.. Mattermost Advisory ID: MMSA-2026-00689
Mattermost Cloud· Jul 13, 2026
5.4Med
CVE-2026-10085 (opens in a new tab)
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict the group_constrained channel flag to public and private channels that support group synchronization, which allows an ordinary group or direct message member to remove all participants from the conversation via the channel patch API.. Mattermost Advisory ID: MMSA-2026-00688
Mattermost Cloud· Jul 13, 2026
5.4Med
CVE-2026-8595 (opens in a new tab)
A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).
Grafana Cloud· Jul 10, 2026
5.8Med
CVE-2026-0278 (opens in a new tab)
Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) component for Windows allow a local user to bypass DLP policy enforcement controls. The Prisma Access Agent on macOS is not affected.
Palo Alto Networks· Jul 9, 2026
5.7Med
CVE-2026-0277 (opens in a new tab)
An improper certificate validation vulnerability in the Prisma® Access Agent for iOS enables an attacker to perform a man-in-the-middle (MitM) attack to intercept VPN traffic. The Prisma Access Agent on Windows, macOS, Linux, Android and ChromeOS are not affected.
Palo Alto Networks· Jul 9, 2026
6.6Med
CVE-2026-0287 (opens in a new tab)
Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Repeated attempts to trigger this condition result in the firewall entering maintenance mode. Panorama is not impacted by these vulnerabilities.
Palo Alto Networks· Jul 9, 2026
6.0Med
CVE-2026-0286 (opens in a new tab)
A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to execute arbitrary OS commands as root. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access® are not impacted by this vulnerability.
Palo Alto Networks· Jul 9, 2026
4.7Med
CVE-2026-0285 (opens in a new tab)
A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator with network access to the management web interface to make unauthorized requests from the firewall to internal services. The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . Panorama, Cloud NGFW
Palo Alto Networks· Jul 9, 2026

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 18 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.