CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 26 min ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 00%
High: 2,481100%
Medium: 00%
Low or not scored: 00%

Matching CVEs: 2,481; Last two years
Critical: 0; CVSS 9.0 and above
High: 2,481; CVSS 7.0 to 8.9
Known exploited: 17; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 399 · October 2026

Most CVEs

In each company's software, last two years

Matching CVEs

7.8High
CVE-2025-21387 (opens in a new tab)
Microsoft Excel Remote Code Execution Vulnerability
Microsoft 365· Feb 11, 2025
7.8High
CVE-2025-21386 (opens in a new tab)
Microsoft Excel Remote Code Execution Vulnerability
Microsoft 365· Feb 11, 2025
7.8High
CVE-2025-21381 (opens in a new tab)
Microsoft Excel Remote Code Execution Vulnerability
Microsoft 365· Feb 11, 2025
8.8High
CVE-2025-21177 (opens in a new tab)
Server-side request forgery (ssrf) in Microsoft Dynamics 365 Sales allows an authorized attacker to elevate privileges over a network.
Microsoft 365· Feb 6, 2025
7.5High
CVE-2024-2878 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible for an attacker to cause a denial of service by crafting unusual search terms for branch names.
GitLab· Feb 5, 2025
7.5High
CVE-2024-9631 (opens in a new tab)
An issue was discovered in GitLab CE/EE affecting all versions starting from 13.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, where viewing diffs of MR with conflicts can be slow.
GitLab· Feb 5, 2025
8.8High
CVE-2024-1211 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 in which cross-site request forgery may have been possible on GitLab instances configured to use JWT as an OmniAuth provider.
GitLab· Jan 31, 2025
7.8High
CVE-2025-0145 (opens in a new tab)
Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local access.
Zoom· Jan 30, 2025
8.8High
CVE-2025-21415 (opens in a new tab)
Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network.
Microsoft Azure· Jan 29, 2025
7.8High
CVE-2025-24794 (opens in a new tab)
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. The OCSP response cache uses pickle as the serialization format, potentially leading to local privilege escalation. This vulnerability affects versions 2.7.12 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
Snowflake· Jan 29, 2025
7.0High
CVE-2025-24793 (opens in a new tab)
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandas_tools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
Snowflake· Jan 29, 2025
7.1High
CVE-2024-10001 (opens in a new tab)
A Code Injection vulnerability was identified in GitHub Enterprise Server that allowed attackers to inject malicious code into the query selector via the identity property in the message handling function. This enabled the exfiltration of sensitive data by manipulating the DOM, including authentication tokens. To execute the attack, the victim must be logged into GitHub and interact with the attacker controlled malicious webpage containing the hidden iframe. This vulnerability occurs due to an improper sequence of validation, where the origin check occurs after accepting the user-controlled id
GitHub· Jan 29, 2025
7.8High
CVE-2025-24789 (opens in a new tab)
Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. When the EXTERNALBROWSER authentication method is used on Windows, an attacker with write access to a directory in the %PATH% can escalate their privileges to the user that runs the vulnerable JDBC Driver version. This vulnerability affects versions 3.2.3 through 3.21.0 on Windows. Snowflake fixed the issue in version 3.22.0.
Snowflake· Jan 29, 2025
7.8High
CVE-2025-0065 (opens in a new tab)
Improper Neutralization of Argument Delimiters in the TeamViewer_service.exe component of TeamViewer Clients prior version 15.62 for Windows allows an attacker with local unprivileged access on a Windows system to elevate privileges via argument injection.
TeamViewer· Jan 28, 2025
7.1High
CVE-2024-0150 (opens in a new tab)
NVIDIA GPU display driver for Windows and Linux contains a vulnerability where data is written past the end or before the beginning of a buffer. A successful exploit of this vulnerability might lead to information disclosure, denial of service, or data tampering.
NVIDIA· Jan 28, 2025
7.8High
CVE-2024-0146 (opens in a new tab)
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause memory corruption. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, or data tampering.
NVIDIA· Jan 28, 2025
8.4High
CVE-2024-0136 (opens in a new tab)
NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code obtaining read and write access to host devices. This vulnerability is present only when the NVIDIA Container Toolkit is configured in a nondefault way. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
NVIDIA· Jan 28, 2025
7.6High
CVE-2024-0135 (opens in a new tab)
NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to modification of a host binary. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
NVIDIA· Jan 28, 2025
7.5High
CVE-2024-11090 (opens in a new tab)
The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.13 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
Liquid Web· Jan 26, 2025
7.6High
CVE-2025-23369 (opens in a new tab)
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users. Instances not utilizing SAML single sign-on or where the attacker is not already an existing user were not impacted. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12.14, 3.13.10, 3.14.7, 3.15.2, and 3.16.0. This vulnerability was reported via the GitHub Bug Bounty program.
GitHub· Jan 21, 2025
7.5High
CVE-2024-43709 (opens in a new tab)
An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.
Elastic Cloud· Jan 21, 2025
7.5High
CVE-2025-20630 (opens in a new tab)
Mattermost Mobile versions <=2.22.0 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the mobile to crash via creating and sending such a post to a channel.
Mattermost Cloud· Jan 16, 2025
7.5High
CVE-2025-20621 (opens in a new tab)
Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash via creating and sending such a post to a channel.
Mattermost Cloud· Jan 16, 2025
7.5High
CVE-2025-20072 (opens in a new tab)
Mattermost Mobile versions <= 2.22.0 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the mobile via crafted malicious input.
Mattermost Cloud· Jan 16, 2025
7.8High
CVE-2024-27856 (opens in a new tab)
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing a file may lead to unexpected app termination or arbitrary code execution.
Apple (iCloud, App Store and services)· Jan 15, 2025
7.8High
CVE-2025-21402 (opens in a new tab)
Microsoft Office OneNote Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
7.8High
CVE-2025-21395 (opens in a new tab)
Microsoft Access Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
7.8High
CVE-2025-21366 (opens in a new tab)
Microsoft Access Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
7.8High
CVE-2025-21365 (opens in a new tab)
Microsoft Office Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
7.8High
CVE-2025-21364 (opens in a new tab)
Microsoft Excel Security Feature Bypass Vulnerability
Microsoft 365· Jan 14, 2025
7.8High
CVE-2025-21363 (opens in a new tab)
Microsoft Word Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
8.4High
CVE-2025-21362 (opens in a new tab)
Microsoft Excel Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
7.8High
CVE-2025-21361 (opens in a new tab)
Microsoft Outlook Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
7.8High
CVE-2025-21356 (opens in a new tab)
Microsoft Office Visio Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
7.8High
CVE-2025-21354 (opens in a new tab)
Microsoft Excel Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
7.2High
CVE-2025-21348 (opens in a new tab)
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
7.8High
CVE-2025-21346 (opens in a new tab)
Microsoft Office Security Feature Bypass Vulnerability
Microsoft 365· Jan 14, 2025
7.8High
CVE-2025-21345 (opens in a new tab)
Microsoft Office Visio Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
7.8High
CVE-2025-21344 (opens in a new tab)
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
7.8High
CVE-2025-21338 (opens in a new tab)
GDI+ Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
7.8High
CVE-2025-21186 (opens in a new tab)
Microsoft Access Remote Code Execution Vulnerability
Microsoft 365· Jan 14, 2025
7.5High
CVE-2024-12085 (opens in a new tab)
A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.
SUSE· Jan 14, 2025
7.7High
CVE-2025-0107 (opens in a new tab)
An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.
Palo Alto Networks· Jan 11, 2025
7.0High
CVE-2025-0104 (opens in a new tab)
A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft.
Palo Alto Networks· Jan 11, 2025
7.5High
CVE-2025-22390 (opens in a new tab)
An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS due to insufficient enforcement of password complexity requirements. The application permits users to set passwords with a minimum length of 6 characters, lacking adequate complexity to resist modern attack techniques such as password spraying or offline password cracking.
Optimizely· Jan 4, 2025
8.0High
CVE-2025-22389 (opens in a new tab)
An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS, where the application does not properly validate uploaded files. This allows the upload of potentially malicious file types, including .docm .html. When accessed by application users, these files can be used to execute malicious actions or compromise users' systems.
Optimizely· Jan 4, 2025
7.5High
CVE-2025-22387 (opens in a new tab)
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be leveraged for session hijacking.
Optimizely· Jan 4, 2025
7.3High
CVE-2025-22386 (opens in a new tab)
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessions to still be active and usable.
Optimizely· Jan 4, 2025
7.5High
CVE-2025-22384 (opens in a new tab)
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific scenarios where requests are altered before reaching the server.
Optimizely· Jan 4, 2025
7.3High
CVE-2024-55955 (opens in a new tab)
An incorrect permissions assignment vulnerability in Trend Micro Deep Security 20.0 agents between versions 20.0.1-9400 and 20.0.1-23340 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Trend Micro· Dec 31, 2024

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 26 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.