CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 2 h ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 00%
High: 2,476100%
Medium: 00%
Low or not scored: 00%

Matching CVEs: 2,476; Last two years
Critical: 0; CVSS 9.0 and above
High: 2,476; CVSS 7.0 to 8.9
Known exploited: 16; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 399 · October 2026

Most CVEs

In each company's software, last two years

Matching CVEs

7.8High
CVE-2025-47165 (opens in a new tab)
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
8.4High
CVE-2025-47164 (opens in a new tab)
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
8.8High
CVE-2025-47163 (opens in a new tab)
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Jun 10, 2025
8.4High
CVE-2025-47162 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
8.8High
CVE-2024-43706 (opens in a new tab)
Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.
Elastic Cloud· Jun 10, 2025
7.8High
CVE-2025-5335 (opens in a new tab)
A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized in the Autodesk Installer application. Exploitation of this vulnerability may lead to code execution.
Autodesk· Jun 10, 2025
7.5High
CVE-2025-43701 (opens in a new tab)
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of Custom Settings data. This impacts OmniStudio: before version 254.
Salesforce· Jun 10, 2025
7.5High
CVE-2025-43700 (opens in a new tab)
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data. This impacts OmniStudio: before Spring 2025.
Salesforce· Jun 10, 2025
7.5High
CVE-2025-43697 (opens in a new tab)
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (DataMapper) allows exposure of encrypted data. This impacts OmniStudio: before Spring 2025
Salesforce· Jun 10, 2025
7.8High
CVE-2025-5036 (opens in a new tab)
A maliciously crafted RFA file, when linked or imported into Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Autodesk· Jun 2, 2025
8.3High
CVE-2025-3260 (opens in a new tab)
A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1). Impact: - Viewers can view all dashboards/folders regardless of permissions - Editors can view/edit/delete all dashboards/folders regardless of permissions - Editors can create dashboards in any folder regardless of permissions - Anonymous users with viewer/editor roles are similarly affected Organization isolation boundaries remain intact. The vulnerability only affects dashboar
Grafana Cloud· Jun 2, 2025
8.7High
CVE-2025-1763 (opens in a new tab)
An issue has been discovered in GitLab EE that allows for cross-site-scripting attack and content security policy bypass in a user's browser under specific conditions, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1.
GitLab· May 30, 2025
7.5High
CVE-2024-52588 (opens in a new tab)
Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to the application fetching itself, resulting in a server side request forgery (SSRF). This issue has been patched in version 4.25.2.
Strapi Cloud· May 29, 2025
7.8High
CVE-2025-23247 (opens in a new tab)
NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a failure to check the length of a buffer could allow a user to cause the tool to crash or execute arbitrary code by passing in a malformed ELF file. A successful exploit of this vulnerability might lead to arbitrary code execution.
NVIDIA· May 27, 2025
7.8High
CVE-2025-24917 (opens in a new tab)
In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a non-administrative user could stage files in a local directory to run arbitrary code with SYSTEM privileges, potentially leading to local privilege escalation.
Tenable· May 23, 2025
7.8High
CVE-2025-24916 (opens in a new tab)
When installing Tenable Network Monitor to a non-default location on a Windows host, Tenable Network Monitor versions prior to 6.5.1 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location.
Tenable· May 23, 2025
7.5High
CVE-2024-9163 (opens in a new tab)
A business logic error in GitLab CE/EE affecting all versions starting from 12.1 prior to 17.10.7, 17.11 prior to 17.11.3 and 18.0 prior to 18.0.1 where an attacker can cause a branch name confusion in confidential MRs.
GitLab· May 23, 2025
7.5High
CVE-2024-7803 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A Discord webhook integration may cause DoS.
GitLab· May 23, 2025
7.4High
CVE-2025-4366 (opens in a new tab)
A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated request bodies on cache HITs, leading to unauthorized request execution and potential cache poisoning. Fixed in: https://github.com/cloudflare/pingora/commit/fda3317ec822678564d641e7cf1c9b77ee3759ff https://github.com/cloudflare/pingora/commit/fda3317ec822678564d641e7cf1c9b77ee3759ff Impact: The issue could lead to request smuggling in cases where Pingora’s proxying framework, pingora-proxy, is used for caching allowing an attacker to ma
Cloudflare· May 22, 2025
7.5High
CVE-2025-4979 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. An attacker may be able to reveal masked or hidden CI variables (that they did not author) in the WebUI, by simply creating their own variable and observing the HTTP response.
GitLab· May 22, 2025
7.2High
CVE-2025-22157 (opens in a new tab)
This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Core Data Center and Server 5.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Service Management Data Center and Server This PrivEsc (Privilege Escalation) vulnerability, with a CVSS Score of 7.2, allows an attacker to perform actions as a higher-privileged user. Atlassian recommends that Jira Core Data Center and Server and Jira Service Management Data Center and Server customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of t
Jira· May 20, 2025
7.5High
CVE-2025-2099 (opens in a new tab)
A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial of Service (ReDoS) attack. The regular expression used to process code blocks in docstrings contains nested quantifiers, leading to exponential backtracking when processing input with a large number of newline characters. An attacker can exploit this by providing a specially crafted payload, causing high CPU usage and potential application downtime, effectively resulting in a Denial of Service (DoS) scenario.
Hugging Face· May 19, 2025
8.7High
CVE-2025-4600 (opens in a new tab)
A request smuggling vulnerability existed in the Google Cloud Classic Application Load Balancer due to improper handling of chunked-encoded HTTP requests. This allowed attackers to craft requests that could be misinterpreted by backend servers. The issue was fixed by disallowing stray data after a chunk, and is no longer exploitable. No action is required as Classic Application Load Balancer service after 2025-04-26 is not vulnerable.
Google Cloud· May 16, 2025
7.1High
CVE-2025-0131 (opens in a new tab)
An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. However, execution requires that the local user also successfully exploits a race condition, which makes this vulnerability difficult to exploit.
Palo Alto Networks· May 14, 2025
8.2High
CVE-2025-30664 (opens in a new tab)
Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access.
Zoom· May 14, 2025
7.0High
CVE-2025-30663 (opens in a new tab)
Time-of-check time-of-use race condition in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access.
Zoom· May 14, 2025
8.2High
CVE-2025-0130 (opens in a new tab)
A missing exception check in Palo Alto Networks PAN-OS® software with the web proxy feature enabled allows an unauthenticated attacker to send a burst of maliciously crafted packets that causes the firewall to become unresponsive and eventually reboot. Repeated successful attempts to trigger this condition will cause the firewall to enter maintenance mode. This issue does not affect Cloud NGFW or Prisma Access.
Palo Alto Networks· May 14, 2025
7.6High
CVE-2025-3744 (opens in a new tab)
Nomad Enterprise (“Nomad”) jobs using the policy override option are bypassing the mandatory sentinel policies. This vulnerability, identified as CVE-2025-3744, is fixed in Nomad Enterprise 1.10.1, 1.9.9, and 1.8.13.
HashiCorp (HCP / Terraform Cloud)· May 13, 2025
7.8High
CVE-2025-32705 (opens in a new tab)
Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to execute code locally.
Microsoft 365· May 13, 2025
7.8High
CVE-2025-32704 (opens in a new tab)
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· May 13, 2025
7.8High
CVE-2025-30393 (opens in a new tab)
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· May 13, 2025
7.8High
CVE-2025-30388 (opens in a new tab)
Heap-based buffer overflow in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.
Microsoft 365· May 13, 2025
7.8High
CVE-2025-30386 (opens in a new tab)
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· May 13, 2025
7.0High
CVE-2025-30384 (opens in a new tab)
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
Microsoft 365· May 13, 2025
7.8High
CVE-2025-30383 (opens in a new tab)
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· May 13, 2025
7.8High
CVE-2025-30382 (opens in a new tab)
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
Microsoft 365· May 13, 2025
7.8High
CVE-2025-30381 (opens in a new tab)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· May 13, 2025
7.8High
CVE-2025-30379 (opens in a new tab)
Release of invalid pointer or reference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· May 13, 2025
7.0High
CVE-2025-30378 (opens in a new tab)
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.
Microsoft 365· May 13, 2025
7.8High
CVE-2025-30377 (opens in a new tab)
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· May 13, 2025
7.8High
CVE-2025-30376 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· May 13, 2025
7.8High
CVE-2025-30375 (opens in a new tab)
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· May 13, 2025
7.8High
CVE-2025-29979 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· May 13, 2025
7.8High
CVE-2025-29978 (opens in a new tab)
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
Microsoft 365· May 13, 2025
7.8High
CVE-2025-29977 (opens in a new tab)
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· May 13, 2025
7.8High
CVE-2025-29976 (opens in a new tab)
Improper privilege management in Microsoft Office SharePoint allows an authorized attacker to elevate privileges locally.
Microsoft 365· May 13, 2025
7.0High
CVE-2025-29973 (opens in a new tab)
Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally.
Microsoft Azure· May 13, 2025
7.3High
CVE-2025-4525 (opens in a new tab)
A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows. Affected by this issue is some unknown functionality in the library WINSTA.dll. The manipulation leads to uncontrolled search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Discord· May 10, 2025
7.5High
CVE-2025-1278 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 12.0 before 17.9.8, 17.10 before 17.10.6, and 17.11 before 17.11.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.
GitLab· May 9, 2025
7.5High
CVE-2024-8973 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.9.8, from 17.10 prior to 17.10.6, and from 17.11 prior to 17.11.2. It was possible to cause a DoS condition via GitHub import requests using a malicious crafted payload.
GitLab· May 9, 2025

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 2 h ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.