CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 1 h ago

Severity mix

CVSS base severity, as scored in NVD

Critical: 4018%
High: 2,47348%
Medium: 1,99639%
Low or not scored: 2365%

CVEs: 5,106; Last two years
Critical: 401; CVSS 9.0 and above
High: 2,473; CVSS 7.0 to 8.9
Known exploited: 55; On CISA's KEV list

CVEs published

By month, last two years

Peak 834 · October 2026

Most CVEs

In each company's software, last two years

Latest CVEs

8.4High
CVE-2026-19003 (opens in a new tab)
A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's file and folder selection handling, and is reached only when a user opens the setup dialog for such a data source and initiates a file or folder selection. Depending on build configuration, the result may range from abnormal process termination to, under certain conditions, execution of unintended code in the context of the user running th
MongoDB Atlas· Aug 12, 2026
6.3Med
CVE-2026-19503 (opens in a new tab)
MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.
MongoDB Atlas· Aug 12, 2026
6.8Med
CVE-2026-19502 (opens in a new tab)
MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values.
MongoDB Atlas· Aug 12, 2026
8.8High
CVE-2026-19004 (opens in a new tab)
An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.
MongoDB Atlas· Aug 12, 2026
8.8High
CVE-2026-19002 (opens in a new tab)
A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code.
MongoDB Atlas· Aug 12, 2026
9.5Crit
CVE-2026-19001 (opens in a new tab)
The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution.
MongoDB Atlas· Aug 12, 2026
7.1High
CVE-2026-18888 (opens in a new tab)
The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read.
MongoDB Atlas· Aug 12, 2026
4.3Med
CVE-2026-6821 (opens in a new tab)
GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a private project due to missing authorization checks in a merge requests API endpoint.
GitLab· Aug 12, 2026
4.3Med
CVE-2026-4879 (opens in a new tab)
GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to higher-privileged roles due to missing authorization on a merge request API endpoint.
GitLab· Aug 12, 2026
6.0Med
CVE-2026-19643 (opens in a new tab)
An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version 1.11.862.
Amazon Web Services· Aug 12, 2026
6.0Med
CVE-2026-19642 (opens in a new tab)
An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memory corruption in an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version 1.11.862.
Amazon Web Services· Aug 12, 2026
8.5High
CVE-2026-19228 (opens in a new tab)
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests.
GitLab· Aug 12, 2026
4.3Med
CVE-2026-18433 (opens in a new tab)
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect authorization checks in a GraphQL query.
GitLab· Aug 12, 2026
7.1High
CVE-2026-16494 (opens in a new tab)
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a project update endpoint.
GitLab· Aug 12, 2026
8.7High
CVE-2026-15217 (opens in a new tab)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component.
GitLab· Aug 12, 2026
8.7High
CVE-2026-15216 (opens in a new tab)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component.
GitLab· Aug 12, 2026
3.3Low
CVE-2025-9486 (opens in a new tab)
GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed a user with a pending membership to receive permissions granted by a custom role, due to incorrect privilege assignment that did not account for membership state.
GitLab· Aug 12, 2026
4.3Med
CVE-2026-8667 (opens in a new tab)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required maintainer-level permissions due to improper authorization checks.
GitLab· Aug 12, 2026
7.5High
CVE-2026-7427 (opens in a new tab)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to improper input validation.
GitLab· Aug 12, 2026
8.8High
CVE-2026-69106 (opens in a new tab)
A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.
JFrog· Aug 12, 2026
7.5High
CVE-2026-42018 (opens in a new tab)Known exploited
JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-18244 (opens in a new tab)
GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group settings page.
GitLab· Aug 12, 2026
9.0Crit
CVE-2026-16627 (opens in a new tab)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal.
GitLab· Aug 12, 2026
8.5High
CVE-2026-15423 (opens in a new tab)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation.
GitLab· Aug 12, 2026
4.3Med
CVE-2026-70547 (opens in a new tab)
An authenticated user without repository read permission may access package metadata under specific conditions.
JFrog· Aug 12, 2026
5.9Med
CVE-2026-69107 (opens in a new tab)
An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.
JFrog· Aug 12, 2026
8.1High
CVE-2026-69105 (opens in a new tab)
An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.
JFrog· Aug 12, 2026
7.2High
CVE-2026-68759 (opens in a new tab)
A holder of a valid integration credential may impersonate other users under specific conditions.
JFrog· Aug 12, 2026
6.5Med
CVE-2026-68758 (opens in a new tab)
A low-privileged authenticated user may access restricted support information under specific conditions.
JFrog· Aug 12, 2026
5.3Med
CVE-2026-66384 (opens in a new tab)Known exploited
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
JFrog· Aug 12, 2026
6.7Med
CVE-2026-66016 (opens in a new tab)
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.
JFrog· Aug 12, 2026
3.1Low
CVE-2026-65926 (opens in a new tab)
An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.
JFrog· Aug 12, 2026
5.3Med
CVE-2026-68760 (opens in a new tab)
An unauthenticated user may bypass authentication under specific cache conditions.
JFrog· Aug 12, 2026
7.5High
CVE-2026-68757 (opens in a new tab)
A user with access to a valid SAML response may impersonate another user under specific conditions.
JFrog· Aug 12, 2026
6.6Med
CVE-2026-68756 (opens in a new tab)
A party with write access to stored session data may affect JFrog Artifactory under specific conditions.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-68755 (opens in a new tab)
A bundle writer may create misleading release promotion information under specific conditions.
JFrog· Aug 12, 2026
6.5Med
CVE-2026-68754 (opens in a new tab)
A repository publisher without delete permission may modify protected package content under specific conditions.
JFrog· Aug 12, 2026
5.3Med
CVE-2026-68753 (opens in a new tab)
An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.
JFrog· Aug 12, 2026
7.2High
CVE-2026-68752 (opens in a new tab)
A Project Resource Manager may gain broader administrative privileges under specific conditions.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-66382 (opens in a new tab)
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
JFrog· Aug 12, 2026
5.3Med
CVE-2026-66381 (opens in a new tab)
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-66380 (opens in a new tab)
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-66379 (opens in a new tab)
An authenticated user may view private Puppet module metadata without repository read access.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-66378 (opens in a new tab)
An authenticated user without repository read permission may access private NuGet metadata under specific conditions.
JFrog· Aug 12, 2026
5.3Med
CVE-2026-66377 (opens in a new tab)
An unauthenticated user may access restricted repository information under specific conditions.
JFrog· Aug 12, 2026
5.4Med
CVE-2026-66376 (opens in a new tab)
Credentials for a deleted user may remain valid for a short period under specific conditions.
JFrog· Aug 12, 2026
8.1High
CVE-2026-66375 (opens in a new tab)
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.
JFrog· Aug 12, 2026
5.7Med
CVE-2026-18171 (opens in a new tab)
Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its shared-export path, so unprivileged code inside the sandbox can derive that path and write to a host directory the operator attached read-only.
Docker· Aug 12, 2026
5.5Med
CVE-2026-14479 (opens in a new tab)
A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerability to cause the NT AUTHORITY\SYSTEM service to terminate unexpectedly, resulting in a denial-of-service condition.
Autodesk· Aug 12, 2026
7.8High
CVE-2026-14478 (opens in a new tab)
A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated IPC messages into named pipes, modify pipe permissions or ownership, and potentially impact confidentiality, integrity, and availability.
Autodesk· Aug 12, 2026

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 1 h ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.