CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 17 min ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 00%
High: 2,481100%
Medium: 00%
Low or not scored: 00%

Matching CVEs: 2,481; Last two years
Critical: 0; CVSS 9.0 and above
High: 2,481; CVSS 7.0 to 8.9
Known exploited: 17; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 399 · October 2026

Most CVEs

In each company's software, last two years

Matching CVEs

7.5High
CVE-2024-12380 (opens in a new tab)
An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. Certain user inputs in repository mirroring settings could potentially expose sensitive authentication information.
GitLab· Mar 13, 2025
7.1High
CVE-2025-0117 (opens in a new tab)
A reliance on untrusted input for a security decision in the GlobalProtect app on Windows devices potentially enables a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. GlobalProtect App on macOS, Linux, iOS, Android, Chrome OS and GlobalProtect UWP App are not affected.
Palo Alto Networks· Mar 12, 2025
8.2High
CVE-2025-0114 (opens in a new tab)
A Denial of Service (DoS) vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software enables an unauthenticated attacker to render the service unavailable by sending a large number of specially crafted packets over a period of time. This issue affects both the GlobalProtect portal and the GlobalProtect gateway. This issue does not apply to Cloud NGFWs or Prisma Access software.
Palo Alto Networks· Mar 12, 2025
8.8High
CVE-2025-27440 (opens in a new tab)
Heap overflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.
Zoom· Mar 11, 2025
8.8High
CVE-2025-27439 (opens in a new tab)
Buffer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.
Zoom· Mar 11, 2025
8.8High
CVE-2025-0151 (opens in a new tab)
Use after free in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.
Zoom· Mar 11, 2025
7.8High
CVE-2025-26630 (opens in a new tab)
Use after free in Microsoft Office Access allows an unauthorized attacker to execute code locally.
Microsoft 365· Mar 11, 2025
7.8High
CVE-2025-26629 (opens in a new tab)
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Mar 11, 2025
7.0High
CVE-2025-26627 (opens in a new tab)
Improper neutralization of special elements used in a command ('command injection') in Azure Arc allows an authorized attacker to elevate privileges locally.
Microsoft Azure· Mar 11, 2025
7.8High
CVE-2025-24083 (opens in a new tab)
Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Mar 11, 2025
7.8High
CVE-2025-24082 (opens in a new tab)
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Mar 11, 2025
7.8High
CVE-2025-24081 (opens in a new tab)
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Mar 11, 2025
7.8High
CVE-2025-24080 (opens in a new tab)
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Mar 11, 2025
7.8High
CVE-2025-24079 (opens in a new tab)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Mar 11, 2025
7.0High
CVE-2025-24078 (opens in a new tab)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Mar 11, 2025
7.8High
CVE-2025-24077 (opens in a new tab)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Mar 11, 2025
7.8High
CVE-2025-24075 (opens in a new tab)
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Mar 11, 2025
7.8High
CVE-2025-24057 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Mar 11, 2025
8.4High
CVE-2025-24049 (opens in a new tab)
Improper neutralization of special elements used in a command ('command injection') in Azure Command Line Integration (CLI) allows an unauthorized attacker to elevate privileges locally.
Microsoft Azure· Mar 11, 2025
7.5High
CVE-2025-0149 (opens in a new tab)
Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access.
Zoom· Mar 11, 2025
8.1High
CVE-2024-0114 (opens in a new tab)
NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the HGX Management Controller (HMC) that may allow a malicious actor with administrative access on the BMC to access the HMC as an administrator. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
NVIDIA· Mar 5, 2025
7.2High
CVE-2025-1319 (opens in a new tab)
The Site Mailer – SMTP Replacement, Email API Deliverability & Email Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Elementor· Feb 28, 2025
7.8High
CVE-2025-1756 (opens in a new tab)
mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\node_modules\. This issue affects mongosh prior to 2.3.0
MongoDB Atlas· Feb 27, 2025
7.8High
CVE-2025-1755 (opens in a new tab)
MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privileges, when a crafted file is stored in C:\node_modules\. This issue affects MongoDB Compass prior to 1.42.1
MongoDB Atlas· Feb 27, 2025
8.8High
CVE-2025-1692 (opens in a new tab)
The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted text can be used to obfuscate malicious code. This issue affects mongosh versions prior to 2.3.9
MongoDB Atlas· Feb 27, 2025
7.7High
CVE-2024-47053 (opens in a new tab)
This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensitive report data. * Improper Authorization: An authorization flaw exists in Mautic's API Authorization implementation. Any authenticated user, regardless of assigned roles or permissions, can access all reports and their associated data via the API. This bypasses the intended access controls governed by the "Reporting Permissions > View Own" and "Reporting Permissions > View Others" permissions, which should restrict access to non-System
Acquia· Feb 26, 2025
7.6High
CVE-2024-0148 (opens in a new tab)
NVIDIA Jetson Linux and IGX OS image contains a vulnerability in the UEFI firmware RCM boot mode, where an unprivileged attacker with physical access to the device could load untrusted code. A successful exploit might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure. The scope of the impacts can extend to other components.
NVIDIA· Feb 25, 2025
7.5High
CVE-2024-45424 (opens in a new tab)
Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network access.
Zoom· Feb 25, 2025
8.8High
CVE-2024-45421 (opens in a new tab)
Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network access.
Zoom· Feb 25, 2025
8.8High
CVE-2024-45418 (opens in a new tab)
Symlink following in the installer for some Zoom apps for macOS before version 6.1.5 may allow an authenticated user to conduct an escalation of privilege via network access.
Zoom· Feb 25, 2025
7.5High
CVE-2025-25279 (opens in a new tab)
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker could read any arbitrary file on the system via importing and exporting a specially crafted import archive in Boards.
Mattermost Cloud· Feb 24, 2025
8.8High
CVE-2025-1412 (opens in a new tab)
Mattermost versions 9.11.x <= 9.11.6, 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user to escalate their privileges depending on the permissions granted to the bot.
Mattermost Cloud· Feb 24, 2025
8.2High
CVE-2025-1293 (opens in a new tab)
Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0.
HashiCorp (HCP / Terraform Cloud)· Feb 20, 2025
7.5High
CVE-2024-7102 (opens in a new tab)
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.0 which allows an attacker to trigger a pipeline as another user under certain circumstances.
GitLab· Feb 13, 2025
7.1High
CVE-2025-0111 (opens in a new tab)Known exploited
An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does
Palo Alto Networks· Feb 12, 2025
8.6High
CVE-2025-0110 (opens in a new tab)
A command injection vulnerability in the Palo Alto Networks PAN-OS OpenConfig plugin enables an authenticated administrator with the ability to make gNMI requests to the PAN-OS management web interface to bypass system restrictions and run arbitrary commands. The commands are run as the “__openconfig” user (which has the Device Administrator role) on the firewall. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deployment guidelines https://live.paloaltonetworks
Palo Alto Networks· Feb 12, 2025
8.8High
CVE-2025-0108 (opens in a new tab)Known exploited
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enable remote code execution, it can negatively impact integrity and confidentiality of PAN-OS. You can greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practices deploy
Palo Alto Networks· Feb 12, 2025
7.1High
CVE-2025-0937 (opens in a new tab)
Nomad Community and Nomad Enterprise ("Nomad") event stream configured with a wildcard namespace can bypass the ACL Policy allowing reads on other namespaces.
HashiCorp (HCP / Terraform Cloud)· Feb 12, 2025
8.8High
CVE-2024-9870 (opens in a new tab)
An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services.
GitLab· Feb 12, 2025
7.5High
CVE-2025-1212 (opens in a new tab)
An information disclosure vulnerability in GitLab CE/EE affecting all versions from 8.3 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send a crafted request to a backend server to reveal sensitive information.
GitLab· Feb 12, 2025
7.5High
CVE-2025-1042 (opens in a new tab)
An insecure direct object reference vulnerability in GitLab EE affecting all versions from 15.7 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to view repositories in an unauthorized way.
GitLab· Feb 12, 2025
8.1High
CVE-2025-23359 (opens in a new tab)
NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default configuration, where a crafted container image could gain access to the host file system. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
NVIDIA· Feb 12, 2025
7.5High
CVE-2024-0112 (opens in a new tab)
NVIDIA Jetson AGX Orin™ and NVIDIA IGX Orin software contain a vulnerability where an attacker can cause an improper input validation issue by escalating certain permissions to a limited degree. A successful exploit of this vulnerability might lead to code execution, denial of service, data corruption, information disclosure, or escalation of privilege.
NVIDIA· Feb 12, 2025
7.5High
CVE-2025-26495 (opens in a new tab)
Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token (PAT) into logging repositories.This issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14, before 2021.1.16, before 2020.4.19.
Salesforce· Feb 11, 2025
7.7High
CVE-2025-26494 (opens in a new tab)
Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server allows Authentication Bypass.This issue affects Tableau Server: from 2023.3 through 2023.3.5.
Salesforce· Feb 11, 2025
8.0High
CVE-2025-21400 (opens in a new tab)
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft 365· Feb 11, 2025
7.8High
CVE-2025-21397 (opens in a new tab)
Microsoft Office Remote Code Execution Vulnerability
Microsoft 365· Feb 11, 2025
7.8High
CVE-2025-21394 (opens in a new tab)
Microsoft Excel Remote Code Execution Vulnerability
Microsoft 365· Feb 11, 2025
7.8High
CVE-2025-21392 (opens in a new tab)
Microsoft Office Remote Code Execution Vulnerability
Microsoft 365· Feb 11, 2025
7.8High
CVE-2025-21390 (opens in a new tab)
Microsoft Excel Remote Code Execution Vulnerability
Microsoft 365· Feb 11, 2025

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 17 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.