CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 15 min ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical
00%
High
123100%
Medium
00%
Low or not scored
00%
Matching CVEs
123
Last two years
Critical
0
CVSS 9.0 and above
High
123
CVSS 7.0 to 8.9
Known exploited
0
On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 9 · June 2025

  • Total: 116
  • December 2024: 2
  • January 2025: 1
  • February 2025: 6
  • March 2025: 5
  • April 2025: 4
  • May 2025: 6
  • June 2025: 9
  • July 2025: 1
  • August 2025: 2
  • September 2025: 8
  • October 2025: 6
  • November 2025: 1
  • December 2025: 4
  • January 2026: 4
  • February 2026: 8
  • March 2026: 8
  • April 2026: 5
  • May 2026: 6
  • June 2026: 4
  • July 2026: 2
  • August 2026: 9
  • September 2026: 7
  • October 2026: 8
  • November 2026: 0

Most CVEs

In each company's software, last two years

  1. Microsoft 365990
  2. NVIDIA590
  3. GitLab436
  4. Apple (iCloud, App Store and services)348
  5. MongoDB Atlas320
  6. Mattermost Cloud310

Matching CVEs

All servicesMicrosoft 365 990NVIDIA 590GitLab 436Apple (iCloud, App Store and services) 348MongoDB Atlas 320Mattermost Cloud 310Elastic Cloud 246Microsoft Azure 186Palo Alto Networks 184Autodesk 136JFrog 99Grafana Cloud 91Zoom 89HashiCorp (HCP / Terraform Cloud) 85Trend Micro 70Docker 65WatchGuard 61Vercel 59GitHub 56TeamViewer 47Amazon Web Services 38Hugging Face 35Anthropic (Claude) 34Salesforce 34Tenable 34Cloudflare 28Adobe 28Snowflake 23Cursor 22Temporal Cloud 21Shopify 19Canva 19LangChain / LangSmith 19Google Cloud 16Jira 14Ping Identity 13WordPress.com (Automattic) 13Webex 11Optimizely 11Metabase Cloud 10
  1. 7.5High

    CVE-2026-1662 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause Denial of Service by sending specially crafted requests to the Jira events endpoint.

    GitLab· Feb 25, 2026

  2. 7.5High

    CVE-2026-1388 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause regular expression denial of service by sending specially crafted input to a merge request endpoint under certain conditions.

    GitLab· Feb 25, 2026

  3. 7.5High

    CVE-2025-14511 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted files to the container registry event endpoint under certain conditions.

    GitLab· Feb 25, 2026

  4. 7.5High

    CVE-2026-1458 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an unauthenticated user to cause denial of service by uploading malicious files.

    GitLab· Feb 11, 2026

  5. 7.5High

    CVE-2026-1456 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through CPU exhaustion by submitting specially crafted markdown files that trigger exponential processing in markdown preview.

    GitLab· Feb 11, 2026

  6. 7.5High

    CVE-2026-0958 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through memory or CPU exhaustion by bypassing JSON validation middleware limits.

    GitLab· Feb 11, 2026

  7. 7.5High

    CVE-2025-8099 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.8 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions, could have allowed an unauthenticated user to cause denial of service by sending repeated GraphQL queries.

    GitLab· Feb 11, 2026

  8. 7.5High

    CVE-2026-1102 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an unauthenticated user to create a denial of service condition by sending repeated malformed SSH authentication requests.

    GitLab· Jan 22, 2026

  9. 7.4High

    CVE-2026-0723 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an individual with existing knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device responses.

    GitLab· Jan 22, 2026

  10. 7.5High

    CVE-2025-13928 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an unauthenticated user to cause a denial of service condition by exploiting incorrect authorization validation in API endpoints.

    GitLab· Jan 22, 2026

  11. 7.5High

    CVE-2025-13927 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.9 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an unauthenticated user to create a denial of service condition by sending crafted requests with malformed authentication data.

    GitLab· Jan 22, 2026

  12. 8.0High

    CVE-2025-12029 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have, under certain circumstances, allowed an unauthenticated user to perform unauthorized actions on behalf of another user by injecting malicious external scripts into the Swagger UI."

    GitLab· Dec 11, 2025

  13. 7.7High

    CVE-2025-8405 (opens in a new tab)

    GitLab has remediated a security issue in GitLab CE/EE affecting all versions from 17.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to perform unauthorized actions on behalf of other users by injecting malicious HTML into vulnerability code flow displays.

    GitLab· Dec 11, 2025

  14. 8.7High

    CVE-2025-12716 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that, under certain conditions could have allowed an authenticated user to perform unauthorized actions on behalf of another user by creating wiki pages with malicious content.

    GitLab· Dec 11, 2025

  15. 7.5High

    CVE-2025-12562 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an unauthenticated user to create a denial of service condition by sending crafted GraphQL queries that bypass query complexity limits.

    GitLab· Dec 11, 2025

  16. 7.5High

    CVE-2025-12571 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an unauthenticated user to cause a Denial of Service condition by sending specifically crafted requests containing malicious JSON payloads.

    GitLab· Nov 26, 2025

  17. 8.8High

    CVE-2025-11702 (opens in a new tab)

    GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker with specific permissions to hijack project runners from other projects.

    GitLab· Oct 29, 2025

  18. 8.1High

    CVE-2025-11989 (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.6.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to execute unauthorized quick actions by including malicious commands in specific descriptions.

    GitLab· Oct 27, 2025

  19. 7.5High

    CVE-2025-11447 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending GraphQL requests with crafted JSON payloads.

    GitLab· Oct 27, 2025

  20. 7.5High

    CVE-2025-10497 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending specially crafted payloads.

    GitLab· Oct 27, 2025

  21. 7.7High

    CVE-2025-11340 (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 to 18.3.4, 18.4 to 18.4.2 that, under certain conditions, could have allowed authenticated users with read-only API tokens to perform unauthorized write operations on vulnerability records by exploiting incorrectly scoped GraphQL mutations.

    GitLab· Oct 9, 2025

  22. 7.5High

    CVE-2025-10004 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2 that could make the GitLab instance unresponsive or severely degraded by sending crafted GraphQL queries requesting large repository blobs.

    GitLab· Oct 9, 2025

  23. 7.5High

    CVE-2025-8014 (opens in a new tab)

    Denial of Service issue in GraphQL endpoints in Gitlab EE/CE affecting all versions from 11.10 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 allows unauthenticated users to potentially bypass query complexity limits leading to resource exhaustion and service disruption.

    GitLab· Sep 27, 2025

  24. 7.5High

    CVE-2025-11042 (opens in a new tab)

    An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that allows an attacker to cause uncontrolled CPU consumption, potentially leading to a Denial of Service (DoS) condition while using specific GraphQL queries.

    GitLab· Sep 26, 2025

  25. 7.7High

    CVE-2025-9958 (opens in a new tab)

    An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that could have allowed Guest users to access sensitive information stored in virtual registry configurations.

    GitLab· Sep 26, 2025

  26. 8.8High

    CVE-2025-7691 (opens in a new tab)

    A privilege escalation issue has been discovered in GitLab EE affecting all versions from 16.6 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 that could have allowed a developer with specific group management permissions to escalate their privileges and obtain unauthorized access to additional system capabilities.

    GitLab· Sep 26, 2025

  27. 7.2High

    CVE-2025-10871 (opens in a new tab)

    An issue has been discovered in GitLab EE affecting all versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. Project Maintainers can exploit a vulnerability where they can assign custom roles to users with permissions exceeding their own, effectively granting themselves elevated privileges.

    GitLab· Sep 26, 2025

  28. 7.5High

    CVE-2025-10858 (opens in a new tab)

    An issue was discovered in GitLab CE/EE affecting all versions before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that allows unauthenticated users to cause a Denial of Service (DoS) condition while uploading specifically crafted large JSON files.

    GitLab· Sep 26, 2025

  29. 8.8High

    CVE-2025-6454 (opens in a new tab)

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to make unintended internal requests through proxy environments by injecting crafted sequences.

    GitLab· Sep 12, 2025

  30. 7.5High

    CVE-2025-2256 (opens in a new tab)

    An issue has been discovered in GitLab CE/EE affecting all versions from 7.12 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed unauthorized users to render the GitLab instance unresponsive to legitimate users by sending multiple concurrent large SAML responses.

    GitLab· Sep 12, 2025

  31. 7.5High

    CVE-2025-4225 (opens in a new tab)

    An issue has been discovered in GitLab CE/EE affecting all versions from 14.1 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that that under certain conditions could have allowed an unauthenticated attacker to cause a denial-of-service condition affecting all users by sending specially crafted GraphQL requests.

    GitLab· Aug 27, 2025

  32. 7.5High

    CVE-2025-1477 (opens in a new tab)

    An issue has been discovered in GitLab CE/EE affecting all versions from 8.14 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed an unauthenticated user to create a denial of service condition by sending specially crafted payloads to specific integration API endpoints.

    GitLab· Aug 13, 2025

  33. 8.0High

    CVE-2025-6948 (opens in a new tab)

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content.

    GitLab· Jul 10, 2025

  34. 8.8High

    CVE-2025-2938 (opens in a new tab)

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to gain elevated project privileges by requesting access to projects where role modifications during the approval process resulted in unintended permission grants.

    GitLab· Jun 26, 2025

  35. 8.1High

    CVE-2024-4994 (opens in a new tab)

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.1.0 before 16.11.5, all versions starting from 17.0 before 17.0.3, all versions starting from 17.1.0 before 17.1.1 which allowed for a CSRF attack on GitLab's GraphQL API leading to the execution of arbitrary GraphQL mutations.

    GitLab· Jun 20, 2025

  36. 7.5High

    CVE-2024-4025 (opens in a new tab)

    A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions from 7.10 prior before 16.11.5, version 17.0 before 17.0.3, and 17.1 before 17.1.1. It is possible for an attacker to cause a denial of service using a crafted markdown page.

    GitLab· Jun 20, 2025

  37. 7.5High

    CVE-2024-7586 (opens in a new tab)

    An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, where webhook deletion audit log preserved auth credentials.

    GitLab· Jun 20, 2025

  38. 7.5High

    CVE-2025-5982 (opens in a new tab)

    An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.

    GitLab· Jun 12, 2025

  39. 7.5High

    CVE-2025-0673 (opens in a new tab)

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2, allow an attacker to trigger an infinite redirect loop, potentially leading to a denial of service condition.

    GitLab· Jun 12, 2025

  40. 8.7High

    CVE-2025-4278 (opens in a new tab)

    An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2. Under certain conditions html injection in new search page could lead to account takeover.

    GitLab· Jun 12, 2025

  41. 7.5High

    CVE-2025-1516 (opens in a new tab)

    An issue has been discovered in GitLab CE/EE affecting all versions from 8.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper input validation in Tokens Names could be used to trigger a denial of service.

    GitLab· Jun 12, 2025

  42. 7.5High

    CVE-2025-1478 (opens in a new tab)

    An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input validation in Board Names could be used to trigger a denial of service.

    GitLab· Jun 12, 2025

  43. 8.7High

    CVE-2025-1763 (opens in a new tab)

    An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user's browser under specific conditions, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.

    GitLab· May 30, 2025

  44. 7.5High

    CVE-2024-9163 (opens in a new tab)

    A business logic error in GitLab CE/EE affecting all versions starting from 12.1 prior to 17.10.7, 17.11 prior to 17.11.3 and 18.0 prior to 18.0.1 where an attacker can cause a branch name confusion in confidential MRs.

    GitLab· May 23, 2025

  45. 7.5High

    CVE-2024-7803 (opens in a new tab)

    An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A Discord webhook integration may cause DoS.

    GitLab· May 23, 2025

  46. 7.5High

    CVE-2025-4979 (opens in a new tab)

    An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. An attacker may be able to reveal masked or hidden CI variables (that they did not author) in the WebUI, by simply creating their own variable and observing the HTTP response.

    GitLab· May 22, 2025

  47. 7.5High

    CVE-2025-1278 (opens in a new tab)

    An issue has been discovered in GitLab CE/EE affecting all versions from 12.0 before 17.9.8, 17.10 before 17.10.6, and 17.11 before 17.11.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.

    GitLab· May 9, 2025

  48. 7.5High

    CVE-2024-8973 (opens in a new tab)

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.9.8, from 17.10 prior to 17.10.6, and from 17.11 prior to 17.11.2. It was possible to cause a DoS condition via GitHub import requests using a malicious crafted payload.

    GitLab· May 9, 2025

  49. 7.7High

    CVE-2025-1908 (opens in a new tab)

    An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.

    GitLab· Apr 24, 2025

  50. 7.5High

    CVE-2025-0639 (opens in a new tab)

    An issue has been discovered affecting service availability via issue preview in GitLab CE/EE affecting all versions from 16.7 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.

    GitLab· Apr 24, 2025

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

How fresh it is

  • New and changed CVEs: pulled from NVD every two hours; last run 15 min ago
  • Known-exploited flags: updated from CISA in the same run
  • Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.