CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 40 min ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 401100%
High: 00%
Medium: 00%
Low or not scored: 00%

Matching CVEs: 401; Last two years
Critical: 401; CVSS 9.0 and above
High: 0; CVSS 7.0 to 8.9
Known exploited: 30; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 44 · August 2026

Most CVEs

In each company's software, last two years

Matching CVEs

9.8Crit
CVE-2026-62834 (opens in a new tab)
Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network.
Microsoft Azure· Aug 20, 2026
9.8Crit
CVE-2026-47627 (opens in a new tab)
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path traversal. A successful exploit might lead to denial of service.
NVIDIA· Aug 18, 2026
9.1Crit
CVE-2026-47606 (opens in a new tab)
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure.
NVIDIA· Aug 18, 2026
9.1Crit
CVE-2026-19478 (opens in a new tab)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.
GitLab· Aug 17, 2026
9.4Crit
CVE-2026-19682 (opens in a new tab)
A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account.
Tenable· Aug 14, 2026
9.4Crit
CVE-2026-19681 (opens in a new tab)
An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system.
Tenable· Aug 14, 2026
9.4Crit
CVE-2026-19626 (opens in a new tab)
A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in arbitrary code execution with the privileges of the service account.
Tenable· Aug 14, 2026
9.6Crit
CVE-2026-8715 (opens in a new tab)
Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit their contents to a tenant-controlled endpoint, potentially leading to privilege escalation within the cluster. This vulnerability (CVE-2026-8715) is fixed in Vault Secrets Operator 1.5.0.
HashiCorp (HCP / Terraform Cloud)· Aug 13, 2026
9.1Crit
CVE-2026-72676 (opens in a new tab)
Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.
Elastic Cloud· Aug 13, 2026
9.5Crit
CVE-2026-19001 (opens in a new tab)
The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution.
MongoDB Atlas· Aug 12, 2026
9.0Crit
CVE-2026-16627 (opens in a new tab)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal.
GitLab· Aug 12, 2026
9.0Crit
CVE-2026-18691 (opens in a new tab)
An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to be transmitted in a less-protected form, potentially allowing that credential to be recovered. If recovered, the credential could be used to authenticate as the internal superuser to nodes in the deployment.
MongoDB Atlas· Aug 11, 2026
9.3Crit
CVE-2026-70306 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Microsoft 365· Aug 11, 2026
9.8Crit
CVE-2026-65768 (opens in a new tab)
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network.
Microsoft 365· Aug 11, 2026
9.6Crit
CVE-2026-57104 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer allows an unauthorized attacker to elevate privileges over a network.
Microsoft Azure· Aug 11, 2026
9.4Crit
CVE-2026-50516 (opens in a new tab)
Incorrect authorization in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges over a network.
Microsoft Azure· Aug 11, 2026
9.1Crit
CVE-2026-19516 (opens in a new tab)
A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict t
Grafana Cloud· Aug 11, 2026
10.0Crit
CVE-2026-72898 (opens in a new tab)Known exploited
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
Metabase Cloud· Aug 10, 2026
9.6Crit
CVE-2026-70332 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Microsoft 365· Aug 7, 2026
9.1Crit
CVE-2026-68823 (opens in a new tab)
Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.
Microsoft Azure· Aug 7, 2026
10.0Crit
CVE-2026-65667 (opens in a new tab)
Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.
Microsoft 365· Aug 7, 2026
9.6Crit
CVE-2026-62896 (opens in a new tab)
Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.
Microsoft 365· Aug 7, 2026
10.0Crit
CVE-2026-62836 (opens in a new tab)
Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network.
Microsoft Azure· Aug 7, 2026
9.9Crit
CVE-2026-62830 (opens in a new tab)
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
Microsoft Azure· Aug 7, 2026
10.0Crit
CVE-2026-56162 (opens in a new tab)
Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.
Microsoft Azure· Aug 7, 2026
9.6Crit
CVE-2026-56161 (opens in a new tab)
Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.
Microsoft Azure· Aug 7, 2026
9.9Crit
CVE-2026-50515 (opens in a new tab)
Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.
Microsoft Azure· Aug 7, 2026
9.9Crit
CVE-2026-50481 (opens in a new tab)
Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
Microsoft Azure· Aug 7, 2026
9.8Crit
CVE-2026-24254 (opens in a new tab)
NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.
NVIDIA· Aug 4, 2026
10.0Crit
CVE-2026-66803 (opens in a new tab)
Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.
Microsoft Azure· Jul 30, 2026
10.0Crit
CVE-2026-16326 (opens in a new tab)
In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability (CVE-2026-16326) is fixed in consul-mcp-server 0.1.4.
HashiCorp (HCP / Terraform Cloud)· Jul 29, 2026
10.0Crit
CVE-2026-16498 (opens in a new tab)
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.
HashiCorp (HCP / Terraform Cloud)· Jul 28, 2026
9.8Crit
CVE-2026-58630 (opens in a new tab)
Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.
Microsoft Azure· Jul 24, 2026
10.0Crit
CVE-2026-56163 (opens in a new tab)
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
Microsoft Azure· Jul 24, 2026
9.8Crit
CVE-2026-62825 (opens in a new tab)
Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.
Microsoft Azure· Jul 24, 2026
9.8Crit
CVE-2026-58275 (opens in a new tab)
Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.
Microsoft Azure· Jul 24, 2026
9.9Crit
CVE-2026-56160 (opens in a new tab)
Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network.
Microsoft Azure· Jul 24, 2026
9.2Crit
CVE-2026-13072 (opens in a new tab)
When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup.
MongoDB Atlas· Jul 22, 2026
9.4Crit
CVE-2026-64879 (opens in a new tab)
A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.
Tenable· Jul 21, 2026
9.4Crit
CVE-2026-64878 (opens in a new tab)
Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.
Tenable· Jul 21, 2026
9.4Crit
CVE-2026-64877 (opens in a new tab)
An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database.
Tenable· Jul 21, 2026
9.8Crit
CVE-2026-12341 (opens in a new tab)
This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens.
SailPoint· Jul 20, 2026
9.8Crit
CVE-2026-63030 (opens in a new tab)Known exploited
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
WordPress.com (Automattic)· Jul 17, 2026
9.8Crit
CVE-2026-53412 (opens in a new tab)
Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an account takeover via network access.
Zoom· Jul 16, 2026
9.1Crit
CVE-2026-50148 (opens in a new tab)
Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by configuring a Snowflake connection to an attacker-controlled server, because a flaw in the Snowflake JDBC driver can write arbitrary files anywhere on the Metabase host, including replacing one of Metabase's own database driver files that later executes inside the Metabase process. This issue is fixed in ver
Metabase Cloud· Jul 15, 2026
9.8Crit
CVE-2026-24227 (opens in a new tab)
NVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution.
NVIDIA· Jul 14, 2026
9.1Crit
CVE-2026-55040 (opens in a new tab)Known exploited
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
Microsoft 365· Jul 14, 2026
9.8Crit
CVE-2026-58644 (opens in a new tab)Known exploited
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
Microsoft 365· Jul 14, 2026
9.8Crit
CVE-2026-56164 (opens in a new tab)Known exploited
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
Microsoft 365· Jul 14, 2026
9.6Crit
CVE-2026-55008 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Microsoft 365· Jul 14, 2026

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 40 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.