CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 2 h ago

Severity mix

CVSS base severity, as scored in NVD

Critical: 4018%
High: 2,47348%
Medium: 1,99639%
Low or not scored: 2365%

CVEs: 5,106; Last two years
Critical: 401; CVSS 9.0 and above
High: 2,473; CVSS 7.0 to 8.9
Known exploited: 55; On CISA's KEV list

CVEs published

By month, last two years

Peak 834 · October 2026

Most CVEs

In each company's software, last two years

Latest CVEs

7.2High
CVE-2026-0265 (opens in a new tab)
An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Cloud Authentication Service (CAS) is enabled. The risk is higher if CAS is enabled on the management interface and lower when any other login interfaces are used. The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/commun
Palo Alto Networks· May 13, 2026
7.2High
CVE-2026-0264 (opens in a new tab)
A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition (all PAN-OS platforms except Cloud NGFW and Prisma Access) or potentially execute arbitrary code by sending specially crafted network traffic (PA-Series hardware only). Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.
Palo Alto Networks· May 13, 2026
7.2High
CVE-2026-0263 (opens in a new tab)
A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attacker to execute arbitrary code with elevated privileges on the firewall, or cause a denial of service (DoS) condition. Panorama, Cloud NGFW, and Prisma® Access are not impacted by these vulnerabilities.
Palo Alto Networks· May 13, 2026
7.3High
CVE-2026-0237 (opens in a new tab)
An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge. This allows a locally authenticated non-admin user to leverage an exposed communication channel to send unauthorized commands to the browser, bypassing security controls.
Palo Alto Networks· May 13, 2026
5.9Med
CVE-2026-44577 (opens in a new tab)
Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability is fixed in 15.5.16 and 16.2.5.
Vercel· May 13, 2026
5.4Med
CVE-2026-44576 (opens in a new tab)
Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. This vulnerability is fixed in 15.5.16 and 16.2.5.
Vercel· May 13, 2026
7.5High
CVE-2026-44575 (opens in a new tab)
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.
Vercel· May 13, 2026
8.1High
CVE-2026-44574 (opens in a new tab)
Next.js is a React framework for building full-stack web applications. From 15.4.0 to before 15.5.16 and 16.2.5, applications that rely on middleware to protect dynamic routes can be vulnerable to authorization bypass. In affected deployments, specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, which can allow protected content to be rendered without passing the expected middleware check. This vulnerability is fixed in 15.5.16 and 16.2.5.
Vercel· May 13, 2026
7.5High
CVE-2026-44573 (opens in a new tab)
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intended authorization checks. This vulnerability is fixed in 15.5.16 and 16.2.5.
Vercel· May 13, 2026
6.3Med
CVE-2026-2695 (opens in a new tab)
A command injection vulnerability was discovered in TeamViewer DEX Platform On-Premises (former 1E DEX Platform On-Premises) prior to version 9.2. Improper input validation allows authenticated users with at least questioner privileges to inject commands in specific instructions. Exploitation could lead to execution of elevated commands on devices connected to the platform.
TeamViewer· May 13, 2026
8.5High
CVE-2026-45033 (opens in a new tab)
GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent performs git operations. By exploiting git's automatic bare repository discovery during directory traversal, an attacker can set core.fsmonitor or other executable config keys to run arbitrary commands without user awareness or approval. The vulnerability arises because git's core.fsmonitor config key (an
GitHub· May 13, 2026
5.9Med
CVE-2026-44572 (opens in a new tab)
Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. When that happened, the middleware/proxy could treat the request as a data request and replace the standard Location redirect header with the internal x-nextjs-redirect header. Browsers do not follow x-nextjs-redirect, so the response became an unusable redirect for normal clients. If the application was deployed behind a CDN or reverse proxy that caches
Vercel· May 13, 2026
5.5Med
CVE-2026-44479 (opens in a new tab)
Vercel’s AI Cloud is a unified platform for building modern applications. From 50.16.0 to 52.0.0, hen the Vercel CLI runs in non-interactive mode (--non-interactive or auto-detected AI agent), commands that cannot complete autonomously emit JSON payloads with suggested follow-up commands. If the user authenticated via --token or -t on the command line, the token value is included verbatim in those suggestions. The plaintext token may be captured in CI/CD logs, agent transcripts, or other automation output. This vulnerability is fixed in 52.0.1.
Vercel· May 13, 2026
8.5High
CVE-2026-44470 (opens in a new tab)
The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. Prior to 1.3834.0, the CoworkVMService component in Claude Desktop for Windows ran as SYSTEM and did not validate whether the VM bundle directory was a real directory or an NTFS directory junction before creating files within it. A local non-elevated user could replace the user-writable VM bundle directory with a directory junction pointing to an attacker-chosen location, causing the service to create a SYSTEM-owned file in an arbitrary directory. This could be leveraged fo
Anthropic (Claude)· May 13, 2026
7.4High
CVE-2026-44467 (opens in a new tab)
The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. From 1.2581.0 to before 1.4304.0, Claude Desktop's SSH remote development feature verified only whether a hostname existed in ~/.ssh/known_hosts without comparing the server's presented host key against the stored key. This allowed a network-positioned attacker to present an arbitrary SSH host key and have the connection silently accepted, enabling a man-in-the-middle attack on remote development sessions. Successful exploitation required the attacker to be in a network pos
Anthropic (Claude)· May 13, 2026
7.7High
CVE-2026-8336 (opens in a new tab)
After invoking $_internalJsEmit, which is not intended to be directly accessible, or mapreduce command’s map function in a certain way, an authenticated user can subsequently crash mongod when the server-side JavaScript engine (through $where, $function, mapreduce reduce stage, etc.) is used also in a specific way, resulting in a post-authentication denial-of-service. This issue impacts MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
MongoDB Atlas· May 13, 2026
5.3Med
CVE-2026-8202 (opens in a new tab)
Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilization at 100% for an extended period of time. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
MongoDB Atlas· May 13, 2026
6.1Med
CVE-2026-8201 (opens in a new tab)
A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering this vulnerability requires control over the structure of a client's FLE-related query. This issue impacts MongoDB Server’s mongocryptd component v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
MongoDB Atlas· May 13, 2026
4.8Med
CVE-2026-8200 (opens in a new tab)
When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
MongoDB Atlas· May 13, 2026
7.1High
CVE-2026-8199 (opens in a new tab)
An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.
MongoDB Atlas· May 13, 2026
8.7High
CVE-2026-8053 (opens in a new tab)
An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog. Under certain conditions this can result in arbitrary code execution. This issue impacts MongoDB Server v5.0 versions prior to 5.0.33, v6.0 versions prior to 6.0.28, v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.
MongoDB Atlas· May 13, 2026
6.0Med
CVE-2026-8052 (opens in a new tab)
HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-8052) is fixed in version 0.1.2 of the exec2 task driver.
HashiCorp (HCP / Terraform Cloud)· May 12, 2026
8.8High
CVE-2026-7474 (opens in a new tab)
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack. This vulnerability (CVE-2026-7474) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.
HashiCorp (HCP / Terraform Cloud)· May 12, 2026
6.0Med
CVE-2026-6959 (opens in a new tab)
HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-6959) is fixed in Nomad 2.0.1, 1.11.5 and 1.10.11.
HashiCorp (HCP / Terraform Cloud)· May 12, 2026
9.4Crit
CVE-2026-8431 (opens in a new tab)
An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMarker template syntax. This issue affects all MongoDB Ops Manager 7.0 versions and MongoDB Ops Manager versions 8.0.22 and prior.
MongoDB Atlas· May 12, 2026
9.9Crit
CVE-2026-42898 (opens in a new tab)
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
Microsoft 365· May 12, 2026
7.5High
CVE-2026-42893 (opens in a new tab)
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network.
Microsoft 365· May 12, 2026
9.1Crit
CVE-2026-42833 (opens in a new tab)
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
Microsoft 365· May 12, 2026
5.5Med
CVE-2026-42832 (opens in a new tab)
Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.
Microsoft 365· May 12, 2026
7.8High
CVE-2026-42831 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· May 12, 2026
6.5Med
CVE-2026-42830 (opens in a new tab)
Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
Microsoft Azure· May 12, 2026
9.9Crit
CVE-2026-42823 (opens in a new tab)
Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.
Microsoft Azure· May 12, 2026
5.5Med
CVE-2026-41102 (opens in a new tab)
Improper access control in Microsoft Office PowerPoint allows an authorized attacker to perform spoofing locally.
Microsoft 365· May 12, 2026
5.5Med
CVE-2026-41101 (opens in a new tab)
Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.
Microsoft 365· May 12, 2026
4.3Med
CVE-2026-40421 (opens in a new tab)
Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
Microsoft 365· May 12, 2026
8.8High
CVE-2026-40420 (opens in a new tab)
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
Microsoft 365· May 12, 2026
7.8High
CVE-2026-40419 (opens in a new tab)
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
Microsoft 365· May 12, 2026
7.8High
CVE-2026-40418 (opens in a new tab)
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
Microsoft 365· May 12, 2026
7.8High
CVE-2026-40417 (opens in a new tab)
Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally.
Microsoft 365· May 12, 2026
7.8High
CVE-2026-40381 (opens in a new tab)
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
Microsoft Azure· May 12, 2026
8.0High
CVE-2026-40368 (opens in a new tab)
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· May 12, 2026
8.4High
CVE-2026-40367 (opens in a new tab)
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· May 12, 2026
8.4High
CVE-2026-40366 (opens in a new tab)
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· May 12, 2026
8.8High
CVE-2026-40365 (opens in a new tab)
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· May 12, 2026
8.4High
CVE-2026-40364 (opens in a new tab)
Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· May 12, 2026
8.4High
CVE-2026-40363 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· May 12, 2026
7.8High
CVE-2026-40362 (opens in a new tab)
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· May 12, 2026
8.4High
CVE-2026-40361 (opens in a new tab)
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· May 12, 2026
7.8High
CVE-2026-40360 (opens in a new tab)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft 365· May 12, 2026
7.8High
CVE-2026-40359 (opens in a new tab)
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· May 12, 2026

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 2 h ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.