CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 2 h ago

Severity mix

CVSS base severity, as scored in NVD

Critical: 4018%
High: 2,47348%
Medium: 1,99639%
Low or not scored: 2365%

CVEs: 5,106; Last two years
Critical: 401; CVSS 9.0 and above
High: 2,473; CVSS 7.0 to 8.9
Known exploited: 55; On CISA's KEV list

CVEs published

By month, last two years

Peak 834 · October 2026

Most CVEs

In each company's software, last two years

Latest CVEs

6.5Med
CVE-2026-69626 (opens in a new tab)
Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
4.8Med
CVE-2026-69615 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69614 (opens in a new tab)
Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
6.3Med
CVE-2026-69559 (opens in a new tab)
Origin validation error in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69556 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69529 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
7.3High
CVE-2026-69477 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Access allows an authorized attacker to execute code locally.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69465 (opens in a new tab)
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69464 (opens in a new tab)
Execution with unnecessary privileges in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69442 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
5.4Med
CVE-2026-69417 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-69409 (opens in a new tab)
Execution with unnecessary privileges in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
5.4Med
CVE-2026-69402 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Sep 8, 2026
5.9Med
CVE-2026-69382 (opens in a new tab)
Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
8.1High
CVE-2026-69380 (opens in a new tab)
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Microsoft 365· Sep 8, 2026
7.5High
CVE-2026-69378 (opens in a new tab)
Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-69375 (opens in a new tab)
Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-69361 (opens in a new tab)
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Sep 8, 2026
9.3Crit
CVE-2026-69356 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69355 (opens in a new tab)
External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69285 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69282 (opens in a new tab)
Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69273 (opens in a new tab)
Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-69268 (opens in a new tab)
Improper access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
6.8Med
CVE-2026-65812 (opens in a new tab)
Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-65772 (opens in a new tab)
Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
6.5Med
CVE-2026-64918 (opens in a new tab)
Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network.
Microsoft 365· Sep 8, 2026
8.8High
CVE-2026-62895 (opens in a new tab)
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
Microsoft Azure· Sep 8, 2026
7.8High
CVE-2026-62804 (opens in a new tab)
External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Sep 8, 2026
8.1High
CVE-2026-55007 (opens in a new tab)
Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
Microsoft 365· Sep 8, 2026
7.1High
CVE-2026-82076 (opens in a new tab)
An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary database-level read/write privileges to bypass an internal resource limit. Submitting a specially crafted query causes the server to consume memory without bound during query planning, and the resulting exhaustion terminates the server process. This may result in a denial of service affecting all databases served by the affected node.
MongoDB Atlas· Sep 8, 2026
8.7High
CVE-2026-82075 (opens in a new tab)
An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources without any rate limiting, degrading or denying service to legitimate clients. No authentication, elevated privileges, or user interaction is required. Only availability is affected; data confidentiality and integrity are not impacted.
MongoDB Atlas· Sep 8, 2026
7.1High
CVE-2026-82074 (opens in a new tab)
MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually executed, resulting in unauthorized read access to collection data within the target database.
MongoDB Atlas· Sep 8, 2026
7.1High
CVE-2026-82073 (opens in a new tab)
A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an internal command parameter that can be set by external clients, causing a security check to be improperly skipped.
MongoDB Atlas· Sep 8, 2026
7.2High
CVE-2026-82071 (opens in a new tab)
Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary code execution.
MongoDB Atlas· Sep 8, 2026
7.1High
CVE-2026-82070 (opens in a new tab)
A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected credentials from concurrent administrative operations. The same credentials are properly redacted in server log output, but the diagnostic interface omits equivalent redaction. Successful exploitation requires a valid authenticated session with monitoring-level permissions and results in exposure of cleartext credentials that could enable impersonation of other users, including privileged accounts.
MongoDB Atlas· Sep 8, 2026
5.1Med
CVE-2026-82069 (opens in a new tab)
A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypassed when processing search queries through the sharded cluster router. This results in sensitive query literals being stored and made accessible through the query statistics interface.
MongoDB Atlas· Sep 8, 2026
7.1High
CVE-2026-82068 (opens in a new tab)
A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on restart and potentially propagating to additional nodes in a sharded cluster. Manual intervention is required to restore service availability.
MongoDB Atlas· Sep 8, 2026
9.2Crit
CVE-2026-82067 (opens in a new tab)
Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform arbitrary administrative operations, resulting in full impact of data confidentiality, integrity, and availability.
MongoDB Atlas· Sep 8, 2026
5.3Med
CVE-2026-82066 (opens in a new tab)
A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user with database read and write privileges can trigger the security issue through crafted query operations, causing the server to read memory beyond allocated buffer boundaries. The revealed memory contents may be partially observable through diagnostic query statistics output.
MongoDB Atlas· Sep 8, 2026
7.1High
CVE-2026-82065 (opens in a new tab)
A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection creation privileges to cause a persistent denial of service. Insufficient validation of user-supplied storage configuration options permits values that, once persisted to durable metadata, trigger a fatal assertion failure when the metadata is subsequently read by diagnostic operations. The corrupted metadata persists across server restarts and is replicated to other cluster members, requiring manual operator intervention to restore service.
MongoDB Atlas· Sep 8, 2026
8.7High
CVE-2026-82064 (opens in a new tab)
A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an assertion in its read concern processing logic that can be reached without authentication, and the assertion's assumptions about internal state do not hold for all member configurations, causing the server process to terminate.
MongoDB Atlas· Sep 8, 2026
6.0Med
CVE-2026-82063 (opens in a new tab)
A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cause a denial of service. Under specific timing conditions during cursor operations, a stale pointer to a freed resource may be retained and subsequently dereferenced during cursor cleanup, leading to a server process crash.
MongoDB Atlas· Sep 8, 2026
7.0High
CVE-2026-82062 (opens in a new tab)
A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container operations that are disabled by default in production configurations, allowing direct storage-engine writes to arbitrary internal storage tables. The authorization check for these operations validates only the operation's namespace, not the actual storage target, enabling writes to unrelated internal met
MongoDB Atlas· Sep 8, 2026
7.2High
CVE-2026-82061 (opens in a new tab)
A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. No user interaction is required.
MongoDB Atlas· Sep 8, 2026
2.3Low
CVE-2026-82060 (opens in a new tab)
In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the updateLookup full document mode, the crafted values were embedded into internal post-image lookup queries without proper sanitization, causing them to be interpreted as query operators rather than literal equality values. This could result in change stream consumers receiving incorrect post-image documents or
MongoDB Atlas· Sep 8, 2026
6.0Med
CVE-2026-82059 (opens in a new tab)
An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges could trigger an assertion failure in the index key generation code path. In certain build configurations, this assertion failure results in termination of the mongod process, causing a denial of service to all connected clients.
MongoDB Atlas· Sep 8, 2026
7.1High
CVE-2026-82058 (opens in a new tab)
A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error generation path performs unsafe numeric conversion on the user-controlled field name without proper exception handling, resulting in an uncaught exception that terminates the server process. This is possible because incoming wire protocol BSON validation does not enforce that array element field names are valid, in-range
MongoDB Atlas· Sep 8, 2026
7.1High
CVE-2026-82057 (opens in a new tab)
A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the storage engine layer. When documents were subsequently read from the misconfigured collection, the resulting mismatch in expected data format led to corrupted memory interpretation and a server crash. The crafted collection configuration persists across restarts, requiring manual operator intervention
MongoDB Atlas· Sep 8, 2026
6.0Med
CVE-2026-82056 (opens in a new tab)
A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been freed, leading to a server crash. An authenticated user with readWrite privileges can trigger this condition through specific concurrent text-search and index management operations, resulting in denial of service for all connected clients. This
MongoDB Atlas· Sep 8, 2026

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 2 h ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.