CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 1 h ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 00%
High: 2,476100%
Medium: 00%
Low or not scored: 00%

Matching CVEs: 2,476; Last two years
Critical: 0; CVSS 9.0 and above
High: 2,476; CVSS 7.0 to 8.9
Known exploited: 16; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 399 · October 2026

Most CVEs

In each company's software, last two years

Matching CVEs

8.2High
CVE-2025-52454 (opens in a new tab)
Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Amazon S3 Connector modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
Salesforce· Jul 25, 2025
8.2High
CVE-2025-52453 (opens in a new tab)
Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
Salesforce· Jul 25, 2025
8.5High
CVE-2025-52452 (opens in a new tab)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - duplicate-data-source modules) allows Absolute Path Traversal. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
Salesforce· Jul 25, 2025
8.5High
CVE-2025-52449 (opens in a new tab)
Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service modules) allows Alternative Execution Due to Deceptive Filenames (RCE). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
Salesforce· Jul 25, 2025
8.1High
CVE-2025-52448 (opens in a new tab)
Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
Salesforce· Jul 25, 2025
8.1High
CVE-2025-52447 (opens in a new tab)
Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc command modules) allows Interface Manipulation (data access to the production database cluster). This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
Salesforce· Jul 25, 2025
8.0High
CVE-2025-52446 (opens in a new tab)
Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api modules) allows Interface Manipulation (data access to the production database cluster).This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
Salesforce· Jul 25, 2025
7.8High
CVE-2025-5039 (opens in a new tab)
A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context of the current process due to an untrusted search path being utilized.
Autodesk· Jul 24, 2025
7.8High
CVE-2025-6018 (opens in a new tab)
A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unprivileged local attacker (for example, a user logged in via SSH) to obtain the elevated privileges normally reserved for a physically present, "allow_active" user. The highest risk is that the attacker can then perform all allow_active yes Polkit actions, which are typically restricted to console users, potentially gaining unauthorized control over system configurations, services, or other sensitive operations.
SUSE· Jul 23, 2025
7.8High
CVE-2025-5042 (opens in a new tab)
A maliciously crafted RFA file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Autodesk· Jul 22, 2025
8.8High
CVE-2025-49747 (opens in a new tab)
Missing authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
Microsoft Azure· Jul 18, 2025
8.8High
CVE-2025-49746 (opens in a new tab)
Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
Microsoft Azure· Jul 18, 2025
8.8High
CVE-2025-47995 (opens in a new tab)
Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
Microsoft Azure· Jul 18, 2025
7.6High
CVE-2025-6023 (opens in a new tab)
An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0. The open redirect can be chained with path traversal vulnerabilities to achieve XSS. Fixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01
Grafana Cloud· Jul 18, 2025
7.1High
CVE-2025-23270 (opens in a new tab)
NVIDIA Jetson Linux contains a vulnerability in UEFI Management mode, where an unprivileged local attacker may cause exposure of sensitive information via a side channel vulnerability. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.
NVIDIA· Jul 17, 2025
8.5High
CVE-2025-23267 (opens in a new tab)
NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook, where an attacker could cause a link following by using a specially crafted container image. A successful exploit of this vulnerability might lead to data tampering and denial of service.
NVIDIA· Jul 17, 2025
7.6High
CVE-2025-23263 (opens in a new tab)
NVIDIA DOCA-Host and Mellanox OFED contain a vulnerability in the VGT+ feature, where an attacker on a VM might cause escalation of privileges and denial of service on the VLAN.
NVIDIA· Jul 17, 2025
7.2High
CVE-2025-6965 (opens in a new tab)
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.
Apple (iCloud, App Store and services)· Jul 15, 2025
7.8High
CVE-2025-53503 (opens in a new tab)
Trend Micro Cleaner One Pro is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.
Trend Micro· Jul 10, 2025
7.8High
CVE-2025-52837 (opens in a new tab)
Trend Micro Password Manager (Consumer) version 5.8.0.1327 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow an attacker the opportunity to abuse symbolic links and other methods to delete any file/folder and achieve privilege escalation.
Trend Micro· Jul 10, 2025
7.1High
CVE-2025-52521 (opens in a new tab)
Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.
Trend Micro· Jul 10, 2025
7.8High
CVE-2025-5040 (opens in a new tab)
A maliciously crafted RTE file, when parsed through Autodesk Revit, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Autodesk· Jul 10, 2025
7.8High
CVE-2025-5037 (opens in a new tab)
A maliciously crafted RFA, RTE, or RVT file, when parsed through Autodesk Revit, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Autodesk· Jul 10, 2025
8.0High
CVE-2025-6948 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content.
GitLab· Jul 10, 2025
8.4High
CVE-2025-0141 (opens in a new tab)
An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on enables a locally authenticated non administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.
Palo Alto Networks· Jul 9, 2025
7.0High
CVE-2025-49737 (opens in a new tab)
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Teams allows an authorized attacker to elevate privileges locally.
Microsoft 365· Jul 8, 2025
7.8High
CVE-2025-49711 (opens in a new tab)
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Jul 8, 2025
7.8High
CVE-2025-49705 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
Microsoft 365· Jul 8, 2025
8.8High
CVE-2025-49704 (opens in a new tab)Known exploited
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Jul 8, 2025
7.8High
CVE-2025-49703 (opens in a new tab)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Jul 8, 2025
7.8High
CVE-2025-49702 (opens in a new tab)
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Jul 8, 2025
8.8High
CVE-2025-49701 (opens in a new tab)
Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Jul 8, 2025
7.8High
CVE-2025-49700 (opens in a new tab)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Jul 8, 2025
7.0High
CVE-2025-49699 (opens in a new tab)
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Jul 8, 2025
7.8High
CVE-2025-49698 (opens in a new tab)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Jul 8, 2025
8.4High
CVE-2025-49697 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Jul 8, 2025
8.4High
CVE-2025-49696 (opens in a new tab)
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Jul 8, 2025
8.4High
CVE-2025-49695 (opens in a new tab)
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Jul 8, 2025
8.6High
CVE-2025-47994 (opens in a new tab)
Deserialization of untrusted data in Microsoft Office allows an unauthorized attacker to elevate privileges locally.
Microsoft 365· Jul 8, 2025
7.5High
CVE-2025-47988 (opens in a new tab)
Improper control of generation of code ('code injection') in Azure Monitor Agent allows an unauthorized attacker to execute code over an adjacent network.
Microsoft Azure· Jul 8, 2025
7.5High
CVE-2025-6714 (opens in a new tab)
MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data. This affects MongoDB when configured with load balancer support. This issue affects MongoDB Server v6.0 prior to 6.0.23, MongoDB Server v7.0 prior to 7.0.20 and MongoDB Server v8.0 prior to 8.0.9 Required Configuration: This affects MongoDB sharded clusters when configured with load balancer support for mongos using HAProxy on specified ports.
MongoDB Atlas· Jul 7, 2025
7.5High
CVE-2025-3262 (opens in a new tab)
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the huggingface/transformers repository, specifically in version 4.49.0. The vulnerability is due to inefficient regular expression complexity in the `SETTING_RE` variable within the `transformers/commands/chat.py` file. The regex contains repetition groups and non-optimized quantifiers, leading to exponential backtracking when processing 'almost matching' payloads. This can degrade application performance and potentially result in a denial-of-service (DoS) when handling specially crafted input strings. The issue is
Hugging Face· Jul 7, 2025
7.5High
CVE-2025-49826 (opens in a new tab)
Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact customers hosted on Vercel. Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page. This issue has been addressed in version 15.1.8.
Vercel· Jul 3, 2025
7.1High
CVE-2025-36630 (opens in a new tab)
In Tenable Nessus versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log content at SYSTEM privilege.
Tenable· Jul 2, 2025
7.5High
CVE-2025-6710 (opens in a new tab)
MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recursion, resulting in excessive stack space consumption. Such inputs can lead to a stack overflow that causes the server to crash which could occur pre-authorisation. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior to 8.0.5. The same issue affects MongoDB Server v6.0 versions prior to 6.0.21, but an attacker can only induce denial of service after authenticating.
MongoDB Atlas· Jun 26, 2025
7.5High
CVE-2025-6709 (opens in a new tab)
The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentication. This can be reproduced using the mongo shell to send a malicious JSON payload leading to an invariant failure and server crash. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior to 8.0.5. The same issue affects MongoDB Server v6.0 versions prior to 6.0.21, but an attacker can only induce denial of service after authenticating.
MongoDB Atlas· Jun 26, 2025
8.8High
CVE-2025-6706 (opens in a new tab)
An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The crash is triggered on affected versions by issuing an aggregation framework operation using a specific combination of rarely-used aggregation pipeline expressions. This issue affects MongoDB Server v6.0 version prior to 6.0.21, MongoDB Server v7.0 version prior to 7.0.17 and MongoDB Server v8.0 version prior to 8.0.4 when the SBE engine is enabled.
MongoDB Atlas· Jun 26, 2025
8.8High
CVE-2025-2938 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to gain elevated project privileges by requesting access to projects where role modifications during the approval process resulted in unintended permission grants.
GitLab· Jun 26, 2025
7.8High
CVE-2025-23265 (opens in a new tab)
NVIDIA Megatron-LM for all platforms contains a vulnerability in a python component where an attacker may cause a code injection issue by providing a malicious file. A successful exploit of this vulnerability may lead to Code Execution, Escalation of Privileges, Information Disclosure and Data Tampering.
NVIDIA· Jun 24, 2025
7.8High
CVE-2025-23264 (opens in a new tab)
NVIDIA Megatron-LM for all platforms contains a vulnerability in a python component where an attacker may cause a code injection issue by providing a malicious file. A successful exploit of this vulnerability may lead to Code Execution, Escalation of Privileges, Information Disclosure and Data Tampering.
NVIDIA· Jun 24, 2025

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 1 h ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.