CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 5 min ago

Severity mix

CVSS base severity, as scored in NVD

Critical: 4018%
High: 2,47348%
Medium: 1,99639%
Low or not scored: 2365%

CVEs: 5,106; Last two years
Critical: 401; CVSS 9.0 and above
High: 2,473; CVSS 7.0 to 8.9
Known exploited: 55; On CISA's KEV list

CVEs published

By month, last two years

Peak 834 · October 2026

Most CVEs

In each company's software, last two years

Latest CVEs

6.8Med
CVE-2026-115706 (opens in a new tab)
Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages.
Elastic Cloud· Oct 29, 2026
8.0High
CVE-2026-93851 (opens in a new tab)
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send an unintended API request, resulting in replacement of an installed plugin and code execution on the server, via a crafted post containing a forged mention reminder that the administrator clicks. Mattermost Advisory ID: MMSA-2026-00742
Mattermost Cloud· Oct 28, 2026
7.6High
CVE-2026-116641 (opens in a new tab)
The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates to this list. DB Tools version 100.19.0 was compiled with Golang 1.26.8, which does not include this check. The issue is resolved by updating to Golang 1.27.3 in DB Tools 100.20.0
MongoDB Atlas· Oct 28, 2026
6.0Med
CVE-2026-79656 (opens in a new tab)
A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and ID tokens of users who sign in through the Generic OAuth, Google or GitLab providers. Grafana writes these tokens to its logs unredacted when an access or ID token is not a valid JWT, when the ID token is missing (at debug level) or is not a string (exposure of sensitive information in log files). The exposure is bounded by the scopes granted to the configured OAuth client.
Grafana Cloud· Oct 28, 2026
7.7High
CVE-2026-88967 (opens in a new tab)
A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).
Grafana Cloud· Oct 28, 2026
6.5Med
CVE-2026-88858 (opens in a new tab)
A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.
Grafana Cloud· Oct 28, 2026
6.9Med
CVE-2026-118581 (opens in a new tab)
A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in such a document and uses it as part of a command can therefore emit a structurally inconsistent message, causing the database to interpret attacker-supplied trailing content as additional fields of the surrounding command. No authentication to the driver or database is required beyond the ability to i
MongoDB Atlas· Oct 28, 2026
7.7High
CVE-2026-118510 (opens in a new tab)
A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide which documents a request may see or act on, a user with basic privileges may be served, may change, or may remove documents that the check was intended to withhold. The failure is silent and produces no error.
MongoDB Atlas· Oct 28, 2026
8.9High
CVE-2026-103506 (opens in a new tab)
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.
Grafana Cloud· Oct 28, 2026
7.7High
CVE-2026-100105 (opens in a new tab)
A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization).
Grafana Cloud· Oct 28, 2026
6.5Med
CVE-2026-16491 (opens in a new tab)
Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.
Grafana Cloud· Oct 27, 2026
7.8High
CVE-2026-113775 (opens in a new tab)
A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can trigger an Exposed Dangerous Function vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to execute arbitrary code in the context of the current process.
Autodesk· Oct 27, 2026
7.1High
CVE-2026-102638 (opens in a new tab)
A maliciously crafted HTML payload in the description of an electronic library (.lbr) file, when displayed in the Library Manager after the library is imported, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
Autodesk· Oct 27, 2026
7.1High
CVE-2026-102637 (opens in a new tab)
A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
Autodesk· Oct 27, 2026
7.1High
CVE-2026-102636 (opens in a new tab)
A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
Autodesk· Oct 27, 2026
7.8High
CVE-2026-92377 (opens in a new tab)
Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allows a local authenticated attacker with low privileges to supply a signed executable through a forged IPC response and cause it to load a malicious DLL from a user-writable temporary directory. Successful exploitation results in arbitrary code execution with NT AUTHORITY\SYSTEM privileges.
TeamViewer· Oct 27, 2026
7.8High
CVE-2026-92376 (opens in a new tab)
Improper authentication in the inter-process communication (IPC) mechanism of TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC broker and cause the Monitoring service to execute arbitrary code with NT AUTHORITY\SYSTEM privileges, resulting in local privilege escalation.
TeamViewer· Oct 27, 2026
7.8High
CVE-2026-92375 (opens in a new tab)
An improper access control vulnerability in the IPC communication between TeamViewer Full Client or Host prior to version 15.83 and the Remote Management Monitoring component prior to version 26.10.1 allows a local authenticated attacker with low privileges to execute scripts as SYSTEM/root.
TeamViewer· Oct 27, 2026
7.8High
CVE-2026-92374 (opens in a new tab)
A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root.
TeamViewer· Oct 27, 2026
8.8High
CVE-2026-92372 (opens in a new tab)
An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer Full Client for Linux and macOS prior to version 15.83 allows a remote attacker to execute arbitrary code by supplying crafted screen-image data during a remote-control session. The vulnerability can also be exploited by persuading a user to open a specially crafted TeamViewer session recording (.tvs). Missing destination bounds checking in the decoder allows crafted screen-image data to cause an out-of-bounds write to the image buffer. Exploitation requires user interaction.
TeamViewer· Oct 27, 2026
8.8High
CVE-2026-111585 (opens in a new tab)
An integer overflow in the remote-control screen processing component of TeamViewer clients (Full Client, Portable and Remote Control App) prior to version 15.83 may allow a malicious remote host to cause a denial of service or, depending on the platform, potentially execute arbitrary code with the privileges of the viewer process. Exploitation requires a user to establish a remote-control session to an attacker-controlled or compromised host.
TeamViewer· Oct 27, 2026
7.3High
CVE-2026-111584 (opens in a new tab)
A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation.
TeamViewer· Oct 27, 2026
7.3High
CVE-2026-111583 (opens in a new tab)
Improper access control in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.82 for Windows during installation of Advanced Asset Management allows a local authenticated user with low privileges to execute arbitrary commands as SYSTEM. An attacker can place a crafted installer options file that is processed by the Advanced Asset Management installer during service activation.
TeamViewer· Oct 27, 2026
7.3High
CVE-2026-111582 (opens in a new tab)
A DLL loading vulnerability in the TeamViewer Remote Management Monitoring installer for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges. Exploitation requires user interaction.
TeamViewer· Oct 27, 2026
8.8High
CVE-2026-107672 (opens in a new tab)
A maliciously crafted .stack.json file can trigger a trusted Markdown injection vulnerability in Autodesk Fusion Post Processor Utility Extension. A malicious actor may exploit this vulnerability to execute arbitrary commands in the context of the current user.
Autodesk· Oct 27, 2026
8.4High
CVE-2026-65151 (opens in a new tab)
NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue. A successful exploit of this vulnerability might lead to data tampering, denial of service and information disclosure.
NVIDIA· Oct 27, 2026
10.0Crit
CVE-2026-65145 (opens in a new tab)
NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.
NVIDIA· Oct 27, 2026
7.1High
CVE-2026-65120 (opens in a new tab)
NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.
NVIDIA· Oct 27, 2026
8.4High
CVE-2026-65119 (opens in a new tab)
NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusion of functionality from an untrusted control sphere. A successful exploit might lead to code execution, information disclosure, data tampering, and denial of service.
NVIDIA· Oct 27, 2026
7.8High
CVE-2026-47486 (opens in a new tab)
NVIDIA PhysX for all platforms contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, information disclosure.
NVIDIA· Oct 27, 2026
7.1High
CVE-2026-24269 (opens in a new tab)
NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure and data tampering.
NVIDIA· Oct 27, 2026
5.7Med
CVE-2026-114409 (opens in a new tab)
Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are not Docker account tokens. Docker Desktop 4.94.0 and 4.95.0 addressed the known logging paths, but logs containing credentials can remain after upgrading. Docker Desktop 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps.
Docker· Oct 27, 2026
7.5High
CVE-2026-86992 (opens in a new tab)
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted video file may lead to unexpected app termination.
Apple (iCloud, App Store and services)· Oct 26, 2026
7.5High
CVE-2026-86991 (opens in a new tab)
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted file may lead to unexpected process termination.
Apple (iCloud, App Store and services)· Oct 26, 2026
5.1Med
CVE-2026-86990 (opens in a new tab)
An access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, visionOS 27.2. A malicious app may be able to access the camera without user permission.
Apple (iCloud, App Store and services)· Oct 26, 2026
5.1Med
CVE-2026-86989 (opens in a new tab)
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to fingerprint the user.
Apple (iCloud, App Store and services)· Oct 26, 2026
4.3Med
CVE-2026-86988 (opens in a new tab)
The issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted image may result in disclosure of process memory.
Apple (iCloud, App Store and services)· Oct 26, 2026
7.5High
CVE-2026-86986 (opens in a new tab)
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Apple (iCloud, App Store and services)· Oct 26, 2026
6.5Med
CVE-2026-86985 (opens in a new tab)
This issue was addressed with improved input validation. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2. Processing maliciously crafted web content may lead to an unexpected process crash.
Apple (iCloud, App Store and services)· Oct 26, 2026
5.5Med
CVE-2026-86984 (opens in a new tab)
A file access issue existed with certain home folder files. This was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access information about a user's contacts.
Apple (iCloud, App Store and services)· Oct 26, 2026
3.3Low
CVE-2026-86978 (opens in a new tab)
This issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2. An app may be able to access sensitive user data.
Apple (iCloud, App Store and services)· Oct 26, 2026
7.5High
CVE-2026-86974 (opens in a new tab)
A type confusion issue was addressed with improved checks. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. Processing maliciously crafted web content may lead to memory corruption.
Apple (iCloud, App Store and services)· Oct 26, 2026
6.5Med
CVE-2026-86973 (opens in a new tab)
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2. Processing maliciously crafted web content may lead to an unexpected process crash.
Apple (iCloud, App Store and services)· Oct 26, 2026
7.8High
CVE-2026-86972 (opens in a new tab)
A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted audio file may lead to memory corruption.
Apple (iCloud, App Store and services)· Oct 26, 2026
6.5Med
CVE-2026-86971 (opens in a new tab)
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted image may lead to unexpected app termination.
Apple (iCloud, App Store and services)· Oct 26, 2026
5.5Med
CVE-2026-86970 (opens in a new tab)
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. Processing a maliciously crafted font may result in the disclosure of process memory.
Apple (iCloud, App Store and services)· Oct 26, 2026
7.5High
CVE-2026-86969 (opens in a new tab)
An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
Apple (iCloud, App Store and services)· Oct 26, 2026
7.5High
CVE-2026-86968 (opens in a new tab)
An access issue was addressed with improved access control. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. A malicious app may be able to access restricted system interfaces or launder launch attribution.
Apple (iCloud, App Store and services)· Oct 26, 2026
5.5Med
CVE-2026-86966 (opens in a new tab)
This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27. An app may be able to modify protected parts of the file system.
Apple (iCloud, App Store and services)· Oct 26, 2026
7.5High
CVE-2026-86964 (opens in a new tab)
A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination.
Apple (iCloud, App Store and services)· Oct 26, 2026

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 5 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.