CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 1 h ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 00%
High: 2,476100%
Medium: 00%
Low or not scored: 00%

Matching CVEs: 2,476; Last two years
Critical: 0; CVSS 9.0 and above
High: 2,476; CVSS 7.0 to 8.9
Known exploited: 16; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 399 · October 2026

Most CVEs

In each company's software, last two years

Matching CVEs

7.8High
CVE-2026-47642 (opens in a new tab)
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Jul 14, 2026
7.8High
CVE-2026-47290 (opens in a new tab)
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Jul 14, 2026
7.8High
CVE-2026-58618 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Jul 14, 2026
8.8High
CVE-2026-57969 (opens in a new tab)
Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
Microsoft Azure· Jul 14, 2026
7.8High
CVE-2026-55948 (opens in a new tab)
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Jul 14, 2026
7.8High
CVE-2026-55899 (opens in a new tab)
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Jul 14, 2026
7.8High
CVE-2026-55009 (opens in a new tab)
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
Microsoft 365· Jul 14, 2026
7.8High
CVE-2026-55006 (opens in a new tab)
Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
Microsoft 365· Jul 14, 2026
8.8High
CVE-2026-55005 (opens in a new tab)
Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
Microsoft 365· Jul 14, 2026
7.8High
CVE-2026-50675 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Jul 14, 2026
7.5High
CVE-2026-50653 (opens in a new tab)
Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network.
Microsoft Azure· Jul 14, 2026
7.5High
CVE-2026-50652 (opens in a new tab)
Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network.
Microsoft Azure· Jul 14, 2026
8.2High
CVE-2026-50338 (opens in a new tab)
Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network.
Microsoft Azure· Jul 14, 2026
8.8High
CVE-2026-47632 (opens in a new tab)
Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network.
Microsoft Azure· Jul 14, 2026
7.5High
CVE-2026-12707 (opens in a new tab)
Summary Cloudflare quiche was discovered to be vulnerable to memory resource exhaustion due to unbounded queuing of post-handshake client migration events. Impact quiche supports the connection migration features described in Section 9 of RFC 9000, which allows a single QUIC connection to survive changes in the network path. Although quiche implements the protections described in Section 9.3 of RFC 9000 to limit server state commitment, it was discovered that the collection of PathEvents, intended to be consumed by applications via the path_event_next() function, was not bounded. Once the QUIC
Cloudflare· Jul 14, 2026
7.5High
CVE-2026-12523 (opens in a new tab)
Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames. Impact HTTP/3 defines multiple frame types to support HTTP message exchanges and connection management. Each frame has a length and a payload whose length depends on the frame type. quiche was found to be vulnerable when parsing some frame types to pre-allocating memory based on the declared length. An attacker would not need to send the number of declared bytes to trigger this issue. In addition, quiche was found to not apply QPACK decompr
Cloudflare· Jul 14, 2026
7.5High
CVE-2026-8609 (opens in a new tab)
An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).
Grafana Cloud· Jul 10, 2026
7.5High
CVE-2026-33382 (opens in a new tab)
Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.
Grafana Cloud· Jul 10, 2026
8.8High
CVE-2026-59827 (opens in a new tab)
Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned in H2 native query result columns of type OTHER without validation, allowing an authenticated user who can run native H2 queries to execute code on the Metabase server. This issue is fixed in versions 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4.
Metabase Cloud· Jul 9, 2026
7.2High
CVE-2026-0288 (opens in a new tab)
Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic. The security risk posed by this issue is minimized when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identificat
Palo Alto Networks· Jul 8, 2026
8.7High
CVE-2026-14891 (opens in a new tab)
HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host. This vulnerability, CVE-2026-14891, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.
HashiCorp (HCP / Terraform Cloud)· Jul 8, 2026
7.7High
CVE-2026-14373 (opens in a new tab)
HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host namespace mode options. This may allow an authenticated job submitter to run a container in a host namespace and access information belonging to the host or to other workloads on the same client. This vulnerability, CVE-2026-14373, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.
HashiCorp (HCP / Terraform Cloud)· Jul 8, 2026
7.7High
CVE-2026-14468 (opens in a new tab)
HashiCorp Terraform Enterprise contained an issue in its version control system (VCS) ingestion of registry modules that did not correctly enforce the intended boundary on packaged module content. This may allow an authenticated user to include files from outside the intended repository content in a module and then download them, potentially exposing sensitive files readable by the ingestion process. This vulnerability, CVE-2026-14468, is fixed in Terraform Enterprise v2.0.4 and v1.2.4.
HashiCorp (HCP / Terraform Cloud)· Jul 6, 2026
7.7High
CVE-2026-8247 (opens in a new tab)
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the same local network segment to execute arbitrary code. This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.
WatchGuard· Jul 3, 2026
8.6High
CVE-2026-13722 (opens in a new tab)
WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via the backup/restore feature. An authenticated administrator can exploit this vulnerability to install a tampered firmware image.
WatchGuard· Jul 3, 2026
8.6High
CVE-2026-13384 (opens in a new tab)
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS wgagent process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI.
WatchGuard· Jul 3, 2026
8.6High
CVE-2026-13383 (opens in a new tab)
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS ikestubd process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI.
WatchGuard· Jul 3, 2026
8.7High
CVE-2026-13084 (opens in a new tab)
A null pointer dereference vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to create a denial-of-service (DoS) condition by sending specially crafted IKEv2 messages. This vulnerability affects both the Mobile User VPN with IKEv2 and the Branch Office VPN using IKEv2 when configured with a dynamic gateway peer. This vulnerability affects Fireware OS 11.10.2 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2
WatchGuard· Jul 3, 2026
7.3High
CVE-2026-13079 (opens in a new tab)
A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate their privileges to NT AUTHORITY\SYSTEM on the machine where the client is installed. This issue affects the Mobile VPN with SSL client for Windows up to and including 2026.2.
WatchGuard· Jul 3, 2026
8.6High
CVE-2026-13054 (opens in a new tab)
A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem.
WatchGuard· Jul 3, 2026
8.6High
CVE-2026-13053 (opens in a new tab)
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially crafted CLI command.
WatchGuard· Jul 3, 2026
8.6High
CVE-2026-13050 (opens in a new tab)
An Out-of-bounds Write vulnerability in WatchGuard Fireware OS networkd process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI.
WatchGuard· Jul 3, 2026
8.8High
CVE-2026-45499 (opens in a new tab)
Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network.
Microsoft Azure· Jul 2, 2026
7.6High
CVE-2026-14440 (opens in a new tab)
Description: To issue and renew TLS certificates on behalf of customers, Cloudflare's Universal SSL feature automatically manages the CAA RRset for the customer's zone. This auto-managed RRset is permissive by design (e.g. 'issue "letsencrypt.org"' without parameters). On Universal SSL zones, Cloudflare's authoritative DNS serves this auto-managed RRset at query time, superseding any customer-configured CAA records on the zone. When a customer publishes a stricter CAA record using the RFC 8657 accounturi or validationmethods parameters, the Certificate Authority does not observe those paramete
Cloudflare· Jul 1, 2026
8.0High
CVE-2026-49091 (opens in a new tab)
Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files are subsequently viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data.
Elastic Cloud· Jul 1, 2026
8.6High
CVE-2026-57516 (opens in a new tab)
Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.
Anyscale· Jul 1, 2026
7.5High
CVE-2026-56150 (opens in a new tab)
Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker can submit a specially crafted request to an upload endpoint that causes excessive memory consumption, which may render Fleet Server unavailable.
Elastic Cloud· Jul 1, 2026
7.5High
CVE-2026-24266 (opens in a new tab)
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a use-after-free issue. A successful exploit of this vulnerability might lead to denial of service.
NVIDIA· Jul 1, 2026
7.5High
CVE-2026-24264 (opens in a new tab)
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause improper handling of highly compressed data. A successful exploit of this vulnerability might lead to denial of service.
NVIDIA· Jul 1, 2026
8.5High
CVE-2026-24260 (opens in a new tab)
NVIDIA Container Toolkit for Linux contains a vulnerability where an attacker could cause a time-of-check time-of-use race condition. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, and data tampering.
NVIDIA· Jul 1, 2026
7.8High
CVE-2026-24251 (opens in a new tab)
NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resources. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.
NVIDIA· Jul 1, 2026
7.8High
CVE-2026-24250 (opens in a new tab)
NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper validation of allowed inputs. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.
NVIDIA· Jul 1, 2026
7.8High
CVE-2026-24249 (opens in a new tab)
NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.
NVIDIA· Jul 1, 2026
7.8High
CVE-2026-24248 (opens in a new tab)
NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of code generation. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.
NVIDIA· Jul 1, 2026
7.8High
CVE-2026-24247 (opens in a new tab)
NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.
NVIDIA· Jul 1, 2026
7.8High
CVE-2026-24246 (opens in a new tab)
NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resources. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.
NVIDIA· Jul 1, 2026
7.8High
CVE-2026-24245 (opens in a new tab)
NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.
NVIDIA· Jul 1, 2026
7.8High
CVE-2026-24244 (opens in a new tab)
NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.
NVIDIA· Jul 1, 2026
7.8High
CVE-2026-24243 (opens in a new tab)
NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.
NVIDIA· Jul 1, 2026
7.8High
CVE-2026-24242 (opens in a new tab)
NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.
NVIDIA· Jul 1, 2026

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 1 h ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.