CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 43 min ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 00%
High: 2,473100%
Medium: 00%
Low or not scored: 00%

Matching CVEs: 2,473; Last two years
Critical: 0; CVSS 9.0 and above
High: 2,473; CVSS 7.0 to 8.9
Known exploited: 16; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 399 · October 2026

Most CVEs

In each company's software, last two years

Matching CVEs

7.1High
CVE-2026-114653 (opens in a new tab)
A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that designates certain fields for client-side field-level encryption may have the protection silently fail to apply, so data intended to be encrypted is stored and returned in cleartext; conversely, the rule may apply more broadly than intended. No user action is required to cause the condition, and any party with ordinary read access to the store
MongoDB Atlas· Oct 22, 2026
7.1High
CVE-2026-114652 (opens in a new tab)
A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the application passes into the affected builder surface, without any special privilege beyond ordinary read-write application access, may cause stored data to be modified or removed in ways the application never intended. The result is unauthorized integrity impact on the affected application data; there is no
MongoDB Atlas· Oct 22, 2026
7.6High
CVE-2026-114649 (opens in a new tab)
The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a certificate copying another user's issuer and serial number, without that user's private key, can be given connections authenticated with the other user's certificate. Database operations can then run under the other user's identity, affecting the confidentiality and integrity of data that identity can access.
MongoDB Atlas· Oct 22, 2026
7.2High
CVE-2026-114648 (opens in a new tab)
The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or update to fields the application did not name, which can expose other users' documents and widen updates beyond the intended data. Certain values can also write malformed fields that leave stored documents unreadable by the application until they are repaired.
MongoDB Atlas· Oct 22, 2026
8.2High
CVE-2026-114644 (opens in a new tab)
The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for the lifetime of the process, with no limit on how much accumulates. An unauthenticated remote party who can cause such content to be deserialized can drive unbounded memory growth, exhausting the host application's available memory and denying service. There is no impact to confidentiality or integrity, and no MongoDB server component is a
MongoDB Atlas· Oct 22, 2026
7.1High
CVE-2026-16255 (opens in a new tab)
GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted project and group membership outside the identity provider's control, due to incomplete enforcement of the membership lock on requests created before the lock was enabled.
GitLab· Oct 22, 2026
8.2High
CVE-2026-15723 (opens in a new tab)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.
GitLab· Oct 22, 2026
7.5High
CVE-2026-112212 (opens in a new tab)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.
GitLab· Oct 22, 2026
8.6High
CVE-2026-113870 (opens in a new tab)
MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with the privileges of the user running Compass.
MongoDB Atlas· Oct 21, 2026
8.7High
CVE-2026-105299 (opens in a new tab)
Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and wrote it to the upstream without removing the client's Connection header, other hop-by-hop headers, or the headers Connection nominated, although RFC 9110 Section 7.6.1 requires intermediaries to remove them. The HTTP/2 upstream path already removed Connection and related HTTP/1-specific headers. A client could therefore nominate a header that the application adds in upstream_request_filter (for example, Connection: keep-alive, X-Forwarded-For). A downstream
Cloudflare· Oct 20, 2026
7.5High
CVE-2026-86977 (opens in a new tab)
An authorization issue was addressed with improved network restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to initiate calls or send messages.
Apple (iCloud, App Store and services)· Oct 20, 2026
7.8High
CVE-2026-86961 (opens in a new tab)
A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.
Apple (iCloud, App Store and services)· Oct 20, 2026
8.8High
CVE-2026-86922 (opens in a new tab)
A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution.
Apple (iCloud, App Store and services)· Oct 20, 2026
8.8High
CVE-2026-86919 (opens in a new tab)
A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An attacker with a paired Bluetooth device may be able to execute arbitrary code.
Apple (iCloud, App Store and services)· Oct 20, 2026
8.8High
CVE-2026-84579 (opens in a new tab)
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Opening a file referencing a network share may lead to unexpected software execution.
Apple (iCloud, App Store and services)· Oct 20, 2026
7.8High
CVE-2026-28853 (opens in a new tab)
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate privileges.
Apple (iCloud, App Store and services)· Oct 20, 2026
7.5High
CVE-2026-105297 (opens in a new tab)
Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded header-list size and no limit on concurrent streams. A remote, unauthenticated client can send 1-byte HPACK references to a near-empty header, making the server allocate hundreds of thousands of header fields per stream across an unlimited number of streams on one connection, and use HTTP/2 flow control to keep those streams open. This can exhaust memory and degrade or terminate the Pingora process. Impact Remote, unauthenticated denial of service against a
Cloudflare· Oct 20, 2026
8.2High
CVE-2026-112368 (opens in a new tab)
An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply crafted binary document data to the decoder to exhaust the process stack. This may cause the PHP process using the driver to terminate unexpectedly, resulting in a loss of availability for that process. The condition occurs below the PHP layer and cannot be intercepted by application-level error handling.
MongoDB Atlas· Oct 19, 2026
7.1High
CVE-2026-16453 (opens in a new tab)
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the RelayState.. Mattermost Advisory ID: MMSA-2026-00727
Mattermost Cloud· Oct 16, 2026
8.8High
CVE-2026-108452 (opens in a new tab)
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108451 (opens in a new tab)
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108450 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108449 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
7.5High
CVE-2026-108448 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108447 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108446 (opens in a new tab)
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108445 (opens in a new tab)
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108444 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108443 (opens in a new tab)
Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108442 (opens in a new tab)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108441 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108440 (opens in a new tab)
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108439 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108437 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
7.8High
CVE-2026-108433 (opens in a new tab)
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108432 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108431 (opens in a new tab)
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108430 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108429 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108428 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108427 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.8High
CVE-2026-108426 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 15, 2026
8.6High
CVE-2026-45165 (opens in a new tab)
An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or cause a denial of service (DoS). Idira Security Bulletin CA26-38.
Palo Alto Networks· Oct 15, 2026
7.1High
CVE-2026-9703 (opens in a new tab)
Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source, not only for the Viewer who made the request. Exploitation requires an authenticated Viewer account on the Grafana insta
Grafana Cloud· Oct 15, 2026
8.8High
CVE-2026-88164 (opens in a new tab)
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Microsoft 365· Oct 14, 2026
8.6High
CVE-2026-0322 (opens in a new tab)Known exploited
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS
Palo Alto Networks· Oct 14, 2026
7.5High
CVE-2026-15102 (opens in a new tab)
ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. Exploitation of this vulnerability can lead to unauthorized access to Autodesk services.
Autodesk· Oct 14, 2026
7.8High
CVE-2026-100129 (opens in a new tab)
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Adobe· Oct 13, 2026
7.8High
CVE-2026-100128 (opens in a new tab)
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Adobe· Oct 13, 2026
7.8High
CVE-2026-100127 (opens in a new tab)
Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Adobe· Oct 13, 2026

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 43 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.