CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 1 h ago

Severity mix

CVSS base severity, as scored in NVD

Critical: 4018%
High: 2,47348%
Medium: 1,99639%
Low or not scored: 2365%

CVEs: 5,106; Last two years
Critical: 401; CVSS 9.0 and above
High: 2,473; CVSS 7.0 to 8.9
Known exploited: 55; On CISA's KEV list

CVEs published

By month, last two years

Peak 834 · October 2026

Most CVEs

In each company's software, last two years

Latest CVEs

8.8High
CVE-2026-11325 (opens in a new tab)
Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in `src/index.ts` reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as CLOUDFLARE_API_TOKEN and GITHUB_TOKEN to an attacker. Because this repository has been deprecated since 2024, Cloudflare will not be issuing patches. To remediate this issue, we recommend migrating to `cloudflare/wrangler-action` immediately. Consumers who have already migrated are not affected. Sunse
Cloudflare· Aug 12, 2026
8.2High
CVE-2026-18710 (opens in a new tab)
A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.
MongoDB Atlas· Aug 11, 2026
2.3Low
CVE-2026-65655 (opens in a new tab)
When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue access-token cookies, and refresh-token cookies when provided by the identity provider, without Secure even though the browser completed login over HTTPS. A victim who visits attacker-controlled content while a credential remains live may expose that credential only if the attacker can also steer traffic for
Temporal Cloud· Aug 11, 2026
7.2High
CVE-2026-18712 (opens in a new tab)
An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.
MongoDB Atlas· Aug 11, 2026
7.1High
CVE-2026-18711 (opens in a new tab)
An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server crash or disclosure of freed memory contents within query results.
MongoDB Atlas· Aug 11, 2026
5.9Med
CVE-2026-18709 (opens in a new tab)
An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees.
MongoDB Atlas· Aug 11, 2026
5.3Med
CVE-2026-18708 (opens in a new tab)
An issue in MongoDB Server's JavaScript scripting engine could allow an authenticated user with write privileges to cause code they control to be executed within the query scope of other users, through a specially crafted stored value processed during an internal maintenance cycle. This could result in corruption of query results affecting other users and denial of service targeted at their operations on the same database. Impact is limited to the scripting engine's execution sandbox, which does not provide access to database, filesystem, or network resources.
MongoDB Atlas· Aug 11, 2026
5.3Med
CVE-2026-18707 (opens in a new tab)
An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service.
MongoDB Atlas· Aug 11, 2026
7.5High
CVE-2026-18706 (opens in a new tab)
An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, execution of unintended code.
MongoDB Atlas· Aug 11, 2026
7.1High
CVE-2026-18705 (opens in a new tab)
An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructing an internal request forwarded to the search process.
MongoDB Atlas· Aug 11, 2026
7.1High
CVE-2026-18704 (opens in a new tab)
An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an appropriate authorization check on its embedded operations.
MongoDB Atlas· Aug 11, 2026
2.3Low
CVE-2026-18703 (opens in a new tab)
An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow authentication through a method the administrator intended to disable.
MongoDB Atlas· Aug 11, 2026
5.3Med
CVE-2026-18702 (opens in a new tab)
An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring unauthorized activity, or degrade operational monitoring by causing excessive log volume.
MongoDB Atlas· Aug 11, 2026
7.1High
CVE-2026-18701 (opens in a new tab)
An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service.
MongoDB Atlas· Aug 11, 2026
6.0Med
CVE-2026-18700 (opens in a new tab)
An issue in MongoDB Server's geospatial validation could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed, through concurrent operations against a collection using a certain type of validator. This could result in a server crash, leading to a denial of service.
MongoDB Atlas· Aug 11, 2026
6.0Med
CVE-2026-18699 (opens in a new tab)
An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by submitting a specially formed query against a collection with a text index. This could result in a denial of service, affecting connected clients and in-flight operations.
MongoDB Atlas· Aug 11, 2026
5.3Med
CVE-2026-18698 (opens in a new tab)
An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment configurations, unauthorized modification of system collection data.
MongoDB Atlas· Aug 11, 2026
8.7High
CVE-2026-18697 (opens in a new tab)
An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos (router) process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the affected mongos instance.
MongoDB Atlas· Aug 11, 2026
7.0High
CVE-2026-18696 (opens in a new tab)
An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is due to an inconsistency in how the target collection is determined between the authorization check and the actual operation.
MongoDB Atlas· Aug 11, 2026
7.1High
CVE-2026-18695 (opens in a new tab)
An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to terminate unexpectedly, resulting in a denial of service.
MongoDB Atlas· Aug 11, 2026
7.1High
CVE-2026-18694 (opens in a new tab)
An issue in MongoDB Server's geospatial query processing could allow an authenticated user with write privileges to cause certain malformed geometry data to be stored and later processed without proper validation. Subsequent queries against this data could then result in the server accessing memory outside its intended bounds. This could result in a server crash (denial of service) and may expose a limited amount of server process memory.
MongoDB Atlas· Aug 11, 2026
7.2High
CVE-2026-18693 (opens in a new tab)
An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), exposure of limited memory contents, or memory corruption.
MongoDB Atlas· Aug 11, 2026
7.7High
CVE-2026-18692 (opens in a new tab)
An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution of unintended code.
MongoDB Atlas· Aug 11, 2026
9.0Crit
CVE-2026-18691 (opens in a new tab)
An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to be transmitted in a less-protected form, potentially allowing that credential to be recovered. If recovered, the credential could be used to authenticate as the internal superuser to nodes in the deployment.
MongoDB Atlas· Aug 11, 2026
7.2High
CVE-2026-18690 (opens in a new tab)
An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that their assigned privileges should not permit. This could result in critical system collections being dropped and recreated without proper authorization.
MongoDB Atlas· Aug 11, 2026
7.1High
CVE-2026-18688 (opens in a new tab)
An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash (denial of service) and may potentially expose a limited amount of memory contents.
MongoDB Atlas· Aug 11, 2026
7.1High
CVE-2026-18687 (opens in a new tab)
MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed request that leads to a server crash or excessive internal writes, resulting in resource exhaustion and corruption of encrypted index data.
MongoDB Atlas· Aug 11, 2026
6.7Med
CVE-2026-65680 (opens in a new tab)
Improper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized attacker to elevate privileges locally.
Microsoft 365· Aug 11, 2026
8.7High
CVE-2026-70355 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Microsoft 365· Aug 11, 2026
8.8High
CVE-2026-70340 (opens in a new tab)
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
Microsoft Azure· Aug 11, 2026
8.8High
CVE-2026-70329 (opens in a new tab)
Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Microsoft 365· Aug 11, 2026
6.5Med
CVE-2026-70328 (opens in a new tab)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Aug 11, 2026
6.5Med
CVE-2026-70327 (opens in a new tab)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Aug 11, 2026
8.8High
CVE-2026-70326 (opens in a new tab)
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Microsoft 365· Aug 11, 2026
5.5Med
CVE-2026-70325 (opens in a new tab)
Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
Microsoft 365· Aug 11, 2026
8.8High
CVE-2026-70324 (opens in a new tab)
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Microsoft 365· Aug 11, 2026
5.5Med
CVE-2026-70323 (opens in a new tab)
Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally.
Microsoft 365· Aug 11, 2026
5.5Med
CVE-2026-70322 (opens in a new tab)
Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
Microsoft 365· Aug 11, 2026
8.8High
CVE-2026-70321 (opens in a new tab)
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Aug 11, 2026
5.5Med
CVE-2026-70320 (opens in a new tab)
Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
Microsoft 365· Aug 11, 2026
5.5Med
CVE-2026-70319 (opens in a new tab)
Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
Microsoft 365· Aug 11, 2026
5.5Med
CVE-2026-70318 (opens in a new tab)
Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft 365· Aug 11, 2026
5.5Med
CVE-2026-70317 (opens in a new tab)
Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.
Microsoft 365· Aug 11, 2026
5.5Med
CVE-2026-70316 (opens in a new tab)
Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
Microsoft 365· Aug 11, 2026
5.5Med
CVE-2026-70315 (opens in a new tab)
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
Microsoft 365· Aug 11, 2026
5.5Med
CVE-2026-70314 (opens in a new tab)
Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally.
Microsoft 365· Aug 11, 2026
7.8High
CVE-2026-70313 (opens in a new tab)
Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
Microsoft 365· Aug 11, 2026
5.5Med
CVE-2026-70312 (opens in a new tab)
Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
Microsoft 365· Aug 11, 2026
7.8High
CVE-2026-70311 (opens in a new tab)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Aug 11, 2026
5.5Med
CVE-2026-70310 (opens in a new tab)
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
Microsoft 365· Aug 11, 2026

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 1 h ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.