CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 2 h ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 00%
High: 2,476100%
Medium: 00%
Low or not scored: 00%

Matching CVEs: 2,476; Last two years
Critical: 0; CVSS 9.0 and above
High: 2,476; CVSS 7.0 to 8.9
Known exploited: 16; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 399 · October 2026

Most CVEs

In each company's software, last two years

Matching CVEs

7.0High
CVE-2025-36537 (opens in a new tab)
Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows allows a local unprivileged user to trigger arbitrary file deletion with SYSTEM privileges via leveraging the MSI rollback mechanism. The vulnerability only applies to the Remote Management features: Backup, Monitoring, and Patch Management.
TeamViewer· Jun 24, 2025
8.1High
CVE-2024-4994 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1.0 before 16.11.5, all versions starting from 17.0 before 17.0.3, all versions starting from 17.1.0 before 17.1.1 which allowed for a CSRF attack on GitLab's GraphQL API leading to the execution of arbitrary GraphQL mutations.
GitLab· Jun 20, 2025
7.5High
CVE-2024-4025 (opens in a new tab)
A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions from 7.10 prior before 16.11.5, version 17.0 before 17.0.3, and 17.1 before 17.1.1. It is possible for an attacker to cause a denial of service using a crafted markdown page.
GitLab· Jun 20, 2025
7.5High
CVE-2024-7586 (opens in a new tab)
An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, where webhook deletion audit log preserved auth credentials.
GitLab· Jun 20, 2025
7.5High
CVE-2025-49715 (opens in a new tab)
Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Jun 20, 2025
7.5High
CVE-2025-4821 (opens in a new tab)
Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the path might actually support. An unauthenticated remote attacker can exploit the vulnerability by first completing a handshake and initiating a congestion-controlled data transfer towards itself. Then, it could manipulate the victim's congestion control state by sending ACK frames covering a large range of packet numbers (including packet numbers that had never been sent); see RFC 9000 Section 19.3. The victim could grow the congestion windo
Cloudflare· Jun 18, 2025
7.5High
CVE-2025-23252 (opens in a new tab)
The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to gain access to restricted components. A successful exploit of this vulnerability may lead to information disclosure.
NVIDIA· Jun 18, 2025
7.1High
CVE-2025-49385 (opens in a new tab)
Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.
Trend Micro· Jun 17, 2025
7.1High
CVE-2025-49384 (opens in a new tab)
Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.
Trend Micro· Jun 17, 2025
7.8High
CVE-2025-49218 (opens in a new tab)
A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. This is similar to, but not identical to CVE-2025-49215. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
Trend Micro· Jun 17, 2025
8.8High
CVE-2025-49215 (opens in a new tab)
A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
Trend Micro· Jun 17, 2025
8.8High
CVE-2025-49214 (opens in a new tab)
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code execution on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
Trend Micro· Jun 17, 2025
7.8High
CVE-2025-49211 (opens in a new tab)
A SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
Trend Micro· Jun 17, 2025
7.8High
CVE-2025-30641 (opens in a new tab)
A link following vulnerability in the anti-malware solution portion of Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Trend Micro· Jun 17, 2025
7.8High
CVE-2025-30640 (opens in a new tab)
A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Trend Micro· Jun 17, 2025
7.1High
CVE-2025-30680 (opens in a new tab)
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (SaaS) could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations. Please note: this vulnerability only affects the SaaS instance of Apex Central - customers that automatically apply Trend Micro's monthly maintenance releases to the SaaS instance do not have to take any further action.
Trend Micro· Jun 17, 2025
7.5High
CVE-2025-30679 (opens in a new tab)
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modOSCE component could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations.
Trend Micro· Jun 17, 2025
7.5High
CVE-2025-30678 (opens in a new tab)
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modTMSM component could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations.
Trend Micro· Jun 17, 2025
7.8High
CVE-2025-49158 (opens in a new tab)
An uncontrolled search path vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalation privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Trend Micro· Jun 17, 2025
7.8High
CVE-2025-49157 (opens in a new tab)
A link following vulnerability in the Trend Micro Apex One Damage Cleanup Engine could allow a local attacker to escalation privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Trend Micro· Jun 17, 2025
7.8High
CVE-2025-49156 (opens in a new tab)
A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalation privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Trend Micro· Jun 17, 2025
8.8High
CVE-2025-49155 (opens in a new tab)
An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject malicious code leading to arbitrary code execution on affected installations.
Trend Micro· Jun 17, 2025
7.8High
CVE-2025-49154 (opens in a new tab)
An insecure access control vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security could allow a local attacker to overwrite key memory-mapped files which could then have severe consequences for the security and stability of affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Trend Micro· Jun 17, 2025
7.5High
CVE-2025-47866 (opens in a new tab)
An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affected installations.
Trend Micro· Jun 17, 2025
7.8High
CVE-2025-6087 (opens in a new tab)
A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /_next/image endpoint. This issue allowed attackers to load remote resources from arbitrary hosts under the victim site’s domain for any site deployed using the Cloudflare adapter for Open Next. For example: https://victim-site.com/_next/image?url=https://attacker.com In this example, attacker-controlled content from att
Cloudflare· Jun 16, 2025
7.8High
CVE-2025-36632 (opens in a new tab)
In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could execute code with SYSTEM privilege.
Tenable· Jun 16, 2025
7.8High
CVE-2025-36633 (opens in a new tab)
In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could arbitrarily delete local system files with SYSTEM privilege, potentially leading to local privilege escalation.
Tenable· Jun 13, 2025
7.8High
CVE-2025-36631 (opens in a new tab)
In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log content at SYSTEM privilege.
Tenable· Jun 13, 2025
8.5High
CVE-2025-4232 (opens in a new tab)
An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non administrative user to escalate their privileges to root.
Palo Alto Networks· Jun 13, 2025
8.6High
CVE-2025-4231 (opens in a new tab)
A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrative user to perform actions as the root user. The attacker must have network access to the management web interface and successfully authenticate to exploit this issue. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
Palo Alto Networks· Jun 13, 2025
8.4High
CVE-2025-4230 (opens in a new tab)
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Cloud NGFW and Prisma® Access are not affected by this vulnerability.
Palo Alto Networks· Jun 13, 2025
7.5High
CVE-2025-5982 (opens in a new tab)
An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.
GitLab· Jun 12, 2025
7.5High
CVE-2025-0673 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2, allow an attacker to trigger an infinite redirect loop, potentially leading to a denial of service condition.
GitLab· Jun 12, 2025
8.7High
CVE-2025-4278 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2. Under certain conditions html injection in new search page could lead to account takeover.
GitLab· Jun 12, 2025
7.5High
CVE-2025-1516 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 8.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper input validation in Tokens Names could be used to trigger a denial of service.
GitLab· Jun 12, 2025
7.5High
CVE-2025-1478 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input validation in Board Names could be used to trigger a denial of service.
GitLab· Jun 12, 2025
8.1High
CVE-2025-4922 (opens in a new tab)
Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14.
HashiCorp (HCP / Terraform Cloud)· Jun 11, 2025
8.4High
CVE-2025-32717 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 11, 2025
8.4High
CVE-2025-47957 (opens in a new tab)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
8.4High
CVE-2025-47953 (opens in a new tab)
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
7.8High
CVE-2025-47176 (opens in a new tab)
'.../...//' in Microsoft Office Outlook allows an authorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
7.8High
CVE-2025-47175 (opens in a new tab)
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
7.8High
CVE-2025-47174 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
7.8High
CVE-2025-47173 (opens in a new tab)
Improper input validation in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
8.8High
CVE-2025-47172 (opens in a new tab)
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Jun 10, 2025
7.8High
CVE-2025-47170 (opens in a new tab)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
7.8High
CVE-2025-47169 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
7.8High
CVE-2025-47168 (opens in a new tab)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
8.4High
CVE-2025-47167 (opens in a new tab)
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
8.8High
CVE-2025-47166 (opens in a new tab)
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Jun 10, 2025

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 2 h ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.