CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 40 min ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 00%
High: 00%
Medium: 2,005100%
Low or not scored: 00%

Matching CVEs: 2,005; Last two years
Critical: 0; CVSS 9.0 and above
High: 0; CVSS 7.0 to 8.9
Known exploited: 8; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 358 · October 2026

Most CVEs

In each company's software, last two years

Matching CVEs

6.5Med
CVE-2025-0150 (opens in a new tab)
Incorrect behavior order in some Zoom Workplace Apps for iOS before version 6.3.0 may allow an authenticated user to conduct a denial of service via network access.
Zoom· Mar 11, 2025
6.5Med
CVE-2025-24986 (opens in a new tab)
Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.
Microsoft Azure· Mar 11, 2025
6.7Med
CVE-2025-21199 (opens in a new tab)
Improper privilege management in Azure Agent Installer allows an authorized attacker to elevate privileges locally.
Microsoft Azure· Mar 11, 2025
6.5Med
CVE-2025-1296 (opens in a new tab)
Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.
HashiCorp (HCP / Terraform Cloud)· Mar 10, 2025
4.3Med
CVE-2025-2045 (opens in a new tab)
Improper authorization in GitLab EE affecting all versions from 17.7 prior to 17.7.6, 17.8 prior to 17.8.4, 17.9 prior to 17.9.1 allow users with limited permissions to access to potentially sensitive project analytics data.
GitLab· Mar 6, 2025
5.2Med
CVE-2025-1696 (opens in a new tab)
A vulnerability exists in Docker Desktop prior to version 4.39.0 that could lead to the unintentional disclosure of sensitive information via application logs. In affected versions, proxy configuration data—potentially including sensitive details—was written to log files in clear text whenever an HTTP GET request was made through a proxy. An attacker with read access to these logs could obtain the proxy information and leverage it for further attacks or unauthorized access. Starting with version 4.39.0, Docker Desktop no longer logs the proxy string, thereby mitigating this risk.
Docker· Mar 6, 2025
4.2Med
CVE-2025-1540 (opens in a new tab)
An issue has been discovered in GitLab CE/EE for Self-Managed and Dedicated instances affecting all versions from 17.5 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2. It was possible for a user added as an External to read and clone internal projects under certain circumstances."
GitLab· Mar 6, 2025
6.8Med
CVE-2024-0141 (opens in a new tab)
NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the GPU vBIOS that may allow a malicious actor with tenant level GPU access to write to an unsupported registry causing a bad state. A successful exploit of this vulnerability may lead to denial of service.
NVIDIA· Mar 5, 2025
6.1Med
CVE-2025-0555 (opens in a new tab)
A Cross Site Scripting (XSS) vulnerability in GitLab-EE affecting all versions from 16.6 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows an attacker to bypass security controls and execute arbitrary scripts in a users browser under specific conditions.
GitLab· Mar 3, 2025
6.1Med
CVE-2025-0475 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1. A proxy feature could potentially allow unintended content rendering leading to XSS under specific circumstances.
GitLab· Mar 3, 2025
5.3Med
CVE-2024-10925 (opens in a new tab)
A vulnerability in GitLab-EE affecting all versions from 16.2 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows a Guest user to read Security policy YAML
GitLab· Mar 3, 2025
5.4Med
CVE-2024-8186 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An attacker could inject HMTL into the child item search potentially leading to XSS in certain situations.
GitLab· Mar 3, 2025
6.8Med
CVE-2025-1693 (opens in a new tab)
The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inject control characters into the shell output. This may result in the display of falsified messages that appear to originate from mongosh or the underlying operating system, potentially misleading users into executing unsafe actions. The vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker. This issue affects mongosh versions prior to 2.3.9
MongoDB Atlas· Feb 27, 2025
6.5Med
CVE-2025-1691 (opens in a new tab)
The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can use the autocompletion feature to input and run obfuscated malicious text. This requires user interaction in the form of the user using ‘tab’ to autocomplete text that is a prefix of the attacker’s prepared autocompletion. This issue affects mongosh versions prior to 2.3.9. The vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker.
MongoDB Atlas· Feb 27, 2025
6.5Med
CVE-2024-27246 (opens in a new tab)
Use after free in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.
Zoom· Feb 25, 2025
6.5Med
CVE-2024-27245 (opens in a new tab)
Buffer overflow in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.
Zoom· Feb 25, 2025
6.5Med
CVE-2024-27239 (opens in a new tab)
Use after free in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.
Zoom· Feb 25, 2025
6.5Med
CVE-2024-45426 (opens in a new tab)
Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.
Zoom· Feb 25, 2025
6.5Med
CVE-2024-45425 (opens in a new tab)
Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.
Zoom· Feb 25, 2025
5.5Med
CVE-2024-45417 (opens in a new tab)
Uncontrolled resource consumption in the installer for some Zoom apps for macOS before version 6.1.5 may allow a privileged user to conduct a disclosure of information via local access.
Zoom· Feb 25, 2025
5.4Med
CVE-2024-54444 (opens in a new tab)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stored XSS.This issue affects Elementor Website Builder: from n/a through <= 3.25.10.
Elementor· Feb 25, 2025
4.8Med
CVE-2025-27141 (opens in a new tab)
Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.47.0 and prior to versions 1.50.36, 1.51.14, 1.52.11, and 1.53.2 of Metabase Enterprise Edition, users with impersonation permissions may be able to see results of cached questions, even if their permissions don’t allow them to see the data. If some user runs a question which gets cached, and then an impersonated user runs that question, then the impersonated user sees the same results as the previous user. These cached results may include data the imperson
Metabase Cloud· Feb 24, 2025
4.3Med
CVE-2025-24526 (opens in a new tab)
Mattermost versions 10.1.x <= 10.1.3, 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to restrict channel export of archived channels when the "Allow users to view archived channels" is disabled which allows a user to export channel contents when they shouldn't have access to it
Mattermost Cloud· Feb 24, 2025
6.5Med
CVE-2025-24490 (opens in a new tab)
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statements in the SQL query of boards reordering which allows an attacker to retrieve data from the database, via a SQL injection when reordering specially crafted boards categories.
Mattermost Cloud· Feb 24, 2025
6.5Med
CVE-2025-20051 (opens in a new tab)
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate input when patching and duplicating a board, which allows a user to read any arbitrary file on the system via duplicating a specially crafted block in Boards.
Mattermost Cloud· Feb 24, 2025
5.4Med
CVE-2024-13445 (opens in a new tab)
The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the border, margin and gap parameters in all versions up to, and including, 3.27.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Elementor· Feb 20, 2025
6.8Med
CVE-2025-0112 (opens in a new tab)
A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This vulnerability can also be leveraged by malware to disable the Cortex XDR agent and then perform malicious activity.
Palo Alto Networks· Feb 20, 2025
5.3Med
CVE-2025-0503 (opens in a new tab)
Mattermost versions 9.11.x <= 9.11.6 fail to filter out DMs from the deleted channels endpoint which allows an attacker to infer user IDs and other metadata from deleted DMs if someone had manually marked DMs as deleted in the database.
Mattermost Cloud· Feb 14, 2025
4.8Med
CVE-2025-1071 (opens in a new tab)
A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the spamBlocker module. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user.
WatchGuard· Feb 14, 2025
5.1Med
CVE-2025-0178 (opens in a new tab)
An Improper Input Validation vulnerability in WatchGuard Fireware OS allows an attacker with network access to manipulate the value of the HTTP Host header in requests sent to the Web UI. An attacker could exploit this vulnerability to redirect users to malicious websites, poison the web cache, or inject malicious JavaScript into responses sent by the Web UI.
WatchGuard· Feb 14, 2025
5.7Med
CVE-2024-3303 (opens in a new tab)
An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.6.5, starting from 17.7 prior to 17.7.4, and starting from 17.8 prior to 17.8.2, which allows an attacker to exfiltrate contents of a private issue using prompt injection.
GitLab· Feb 13, 2025
5.3Med
CVE-2025-1198 (opens in a new tab)
An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allowed revoked Personal Access Tokens access to streaming results.
GitLab· Feb 13, 2025
6.6Med
CVE-2024-8266 (opens in a new tab)
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.6.0, which allows an attacker with maintainer role to trigger a pipeline as project owner under certain circumstances.
GitLab· Feb 13, 2025
5.3Med
CVE-2025-0113 (opens in a new tab)
A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to Docker containers from the host network used by Broker VM. This may allow access to read files sent for analysis and logs transmitted by the Cortex XDR Agent to the Cortex XDR server.
Palo Alto Networks· Feb 12, 2025
6.9Med
CVE-2025-0109 (opens in a new tab)
An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attacker with network access to the management web interface to delete certain files as the “nobody” user; this includes limited logs and configuration files but does not include system files. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-ho
Palo Alto Networks· Feb 12, 2025
4.3Med
CVE-2025-0516 (opens in a new tab)
Improper Authorization in GitLab CE/EE affecting all versions from 17.7 prior to 17.7.4, 17.8 prior to 17.8.2 allow users with limited permissions to perform unauthorized actions on critical project data.
GitLab· Feb 12, 2025
6.1Med
CVE-2025-0376 (opens in a new tab)
An XSS vulnerability exists in GitLab CE/EE affecting all versions from 13.3 prior to 17.6.5, 17.7 prior to 17.7.4 and 17.8 prior to 17.8.2 that allows an attacker to execute unauthorized actions via a change page.
GitLab· Feb 12, 2025
6.5Med
CVE-2024-12379 (opens in a new tab)
A denial of service vulnerability in GitLab CE/EE affecting all versions from 14.1 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to impact the availability of GitLab via unbounded symbol creation via the scopes parameter in a Personal Access Token.
GitLab· Feb 12, 2025
6.5Med
CVE-2024-53880 (opens in a new tab)
NVIDIA Triton Inference Server contains a vulnerability in the model loading API, where a user could cause an integer overflow or wraparound error by loading a model with an extra-large file size that overflows an internal variable. A successful exploit of this vulnerability might lead to denial of service.
NVIDIA· Feb 12, 2025
6.8Med
CVE-2024-0145 (opens in a new tab)
NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause a heap-based buffer overflow issue by means of a specially crafted JPEG2000 file. A successful exploit of this vulnerability might lead to code execution and data tampering.
NVIDIA· Feb 12, 2025
6.8Med
CVE-2024-0144 (opens in a new tab)
NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause a buffer overflow issue by means of a specially crafted JPEG2000 file. A successful exploit of this vulnerability might lead to data tampering.
NVIDIA· Feb 12, 2025
6.8Med
CVE-2024-0143 (opens in a new tab)
NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause an out-of-bounds write issue by means of a specially crafted JPEG2000 file. A successful exploit of this vulnerability might lead to code execution and data tampering.
NVIDIA· Feb 12, 2025
6.8Med
CVE-2024-0142 (opens in a new tab)
NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause an out-of-bounds write issue by means of a specially crafted JPEG2000 file. A successful exploit of this vulnerability might lead to code execution and data tampering.
NVIDIA· Feb 12, 2025
5.5Med
CVE-2025-21383 (opens in a new tab)
Microsoft Excel Information Disclosure Vulnerability
Microsoft 365· Feb 11, 2025
5.3Med
CVE-2025-21259 (opens in a new tab)
Microsoft Outlook Spoofing Vulnerability
Microsoft 365· Feb 11, 2025
6.0Med
CVE-2025-21188 (opens in a new tab)
Azure Network Watcher VM Extension Elevation of Privilege Vulnerability
Microsoft Azure· Feb 11, 2025
6.1Med
CVE-2024-10383 (opens in a new tab)
An issue has been discovered in the gitlab-web-ide-vscode-fork component distributed over CDN affecting all versions prior to 1.89.1-1.0.0-dev-20241118094343and used by all versions of GitLab CE/EE starting from 15.11 prior to 17.3 and which also temporarily affected versions 17.4, 17.5 and 17.6, where a XSS attack was possible when loading .ipynb files in the web IDE
GitLab· Feb 7, 2025
6.5Med
CVE-2025-1072 (opens in a new tab)
A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14.1 prior to 17.3.7, 17.4 prior to 17.4.4, and 17.5 prior to 17.5.2. A denial of service could occur upon importing maliciously crafted content using the Fogbugz importer.
GitLab· Feb 7, 2025
6.5Med
CVE-2024-3976 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose via the UI the confidential issues title and description from a public project to unauthorised instance users.
GitLab· Feb 5, 2025
5.4Med
CVE-2024-5528 (opens in a new tab)
An issue was discovered in GitLab CE/EE affecting all versions prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, which allows a subdomain takeover in GitLab Pages.
GitLab· Feb 5, 2025

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 40 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.