CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 47 min ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 00%
High: 2,481100%
Medium: 00%
Low or not scored: 00%

Matching CVEs: 2,481; Last two years
Critical: 0; CVSS 9.0 and above
High: 2,481; CVSS 7.0 to 8.9
Known exploited: 17; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 399 · October 2026

Most CVEs

In each company's software, last two years

Matching CVEs

7.5High
CVE-2024-11828 (opens in a new tab)
A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted API calls. This was a regression of an earlier patch.
GitLab· Nov 26, 2024
7.5High
CVE-2024-11669 (opens in a new tab)
An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints could potentially allow unauthorized access to sensitive data due to overly broad application of token scopes.
GitLab· Nov 26, 2024
7.0High
CVE-2024-27134 (opens in a new tab)
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.
JFrog· Nov 25, 2024
7.6High
CVE-2024-0122 (opens in a new tab)
NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an attacker may cause an unauthorized action. A successful exploit of this vulnerability may lead to partial denial of service and confidential information disclosure.
NVIDIA· Nov 23, 2024
8.8High
CVE-2024-11394 (opens in a new tab)
Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability
Hugging Face· Nov 22, 2024
8.8High
CVE-2024-11393 (opens in a new tab)
Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerab
Hugging Face· Nov 22, 2024
8.8High
CVE-2024-11392 (opens in a new tab)
Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of configuration files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vuln
Hugging Face· Nov 22, 2024
8.3High
CVE-2024-9710 (opens in a new tab)
PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PostHog. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the database_schema method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-25351.
PostHog· Nov 22, 2024
7.5High
CVE-2024-45422 (opens in a new tab)
Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial of service via network access.
Zoom· Nov 19, 2024
7.5High
CVE-2024-45419 (opens in a new tab)
Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via network access.
Zoom· Nov 19, 2024
8.8High
CVE-2024-51503 (opens in a new tab)
A security agent manual scan command injection vulnerability in the Trend Micro Deep Security 20 Agent could allow an attacker to escalate privileges and execute arbitrary code on an affected machine. In certain circumstances, attackers that have legitimate access to the domain may be able to remotely inject commands to other machines in the same domain. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability locally and must have domain user privileges to affect other machines.
Trend Micro· Nov 19, 2024
7.8High
CVE-2024-9500 (opens in a new tab)
A maliciously crafted DLL file when placed in temporary files and folders that are leveraged by the Autodesk Installer could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to insecure privilege management.
Autodesk· Nov 15, 2024
8.8High
CVE-2024-49060 (opens in a new tab)
Azure Stack HCI Elevation of Privilege Vulnerability
Microsoft Azure· Nov 15, 2024
7.2High
CVE-2024-37285 (opens in a new tab)
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv and Kibana privileges https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html assigned to them. The following Elasticsearch indices permissions are required * write privilege on the system indices .kibana_inges
Elastic Cloud· Nov 14, 2024
8.1High
CVE-2024-10921 (opens in a new tab)
An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to 6.0.19, MongoDB Server v7.0 versions prior to 7.0.15 and MongoDB Server v8.0 versions prior to and including 8.0.2.
MongoDB Atlas· Nov 14, 2024
7.5High
CVE-2024-9633 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.4.2, all versions starting from 17.5 before 17.5.4, all versions starting from 17.6 before 17.6.2. This issue allows an attacker to create a group with a name matching an existing unique Pages domain, potentially leading to domain confusion attacks.
GitLab· Nov 14, 2024
8.8High
CVE-2024-9693 (opens in a new tab)
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 prior to 17.5.2, which could have allowed unauthorized access to the Kubernetes agent in a cluster under specific configurations.
GitLab· Nov 14, 2024
8.7High
CVE-2024-9472 (opens in a new tab)
A null pointer dereference in Palo Alto Networks PAN-OS software on PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series hardware platforms when Decryption policy is enabled allows an unauthenticated attacker to crash PAN-OS by sending specific traffic through the data plane, resulting in a denial of service (DoS) condition. Repeated attempts to trigger this condition will result in PAN-OS entering maintenance mode. Palo Alto Networks VM-Series, Cloud NGFW, and Prisma Access are not affected. This issue only affects PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series
Palo Alto Networks· Nov 14, 2024
8.7High
CVE-2024-2551 (opens in a new tab)
A null pointer dereference vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop a core system service on the firewall by sending a crafted packet through the data plane that causes a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the firewall entering maintenance mode.
Palo Alto Networks· Nov 14, 2024
8.7High
CVE-2024-2550 (opens in a new tab)
A null pointer dereference vulnerability in the GlobalProtect gateway in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop the GlobalProtect service on the firewall by sending a specially crafted packet that causes a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the firewall entering maintenance mode.
Palo Alto Networks· Nov 14, 2024
7.2High
CVE-2024-49042 (opens in a new tab)
Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability
Microsoft Azure· Nov 12, 2024
7.2High
CVE-2024-43613 (opens in a new tab)
Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability
Microsoft Azure· Nov 12, 2024
7.5High
CVE-2024-49040 (opens in a new tab)
Microsoft Exchange Server Spoofing Vulnerability
Microsoft 365· Nov 12, 2024
7.5High
CVE-2024-49033 (opens in a new tab)
Microsoft Word Security Feature Bypass Vulnerability
Microsoft 365· Nov 12, 2024
7.8High
CVE-2024-49032 (opens in a new tab)
Microsoft Office Graphics Remote Code Execution Vulnerability
Microsoft 365· Nov 12, 2024
7.8High
CVE-2024-49031 (opens in a new tab)
Microsoft Office Graphics Remote Code Execution Vulnerability
Microsoft 365· Nov 12, 2024
7.8High
CVE-2024-49030 (opens in a new tab)
Microsoft Excel Remote Code Execution Vulnerability
Microsoft 365· Nov 12, 2024
7.8High
CVE-2024-49029 (opens in a new tab)
Microsoft Excel Remote Code Execution Vulnerability
Microsoft 365· Nov 12, 2024
7.8High
CVE-2024-49028 (opens in a new tab)
Microsoft Excel Remote Code Execution Vulnerability
Microsoft 365· Nov 12, 2024
7.8High
CVE-2024-49027 (opens in a new tab)
Microsoft Excel Remote Code Execution Vulnerability
Microsoft 365· Nov 12, 2024
7.8High
CVE-2024-49026 (opens in a new tab)
Microsoft Excel Remote Code Execution Vulnerability
Microsoft 365· Nov 12, 2024

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 47 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.