CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 54 min ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 00%
High: 00%
Medium: 1,996100%
Low or not scored: 00%

Matching CVEs: 1,996; Last two years
Critical: 0; CVSS 9.0 and above
High: 0; CVSS 7.0 to 8.9
Known exploited: 8; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 358 · October 2026

Most CVEs

In each company's software, last two years

Matching CVEs

4.3Med
CVE-2026-18256 (opens in a new tab)
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private teams to disclose the ID, name, and display name of private teams via a modified team search request. Mattermost Advisory ID: MMSA-2026-00748
Mattermost Cloud· Oct 16, 2026
5.0Med
CVE-2026-18223 (opens in a new tab)
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team and guest invitation tokens, which allows an authenticated attacker to join a team or gain unauthorized access to private channels via a forwarded or leaked invitation link.. Mattermost Advisory ID: MMSA-2026-00747
Mattermost Cloud· Oct 16, 2026
6.5Med
CVE-2026-16251 (opens in a new tab)
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized image response.. Mattermost Advisory ID: MMSA-2026-00726
Mattermost Cloud· Oct 16, 2026
4.3Med
CVE-2026-19867 (opens in a new tab)
Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification properties, and to bound the quadratic multibyte-keyword matching performed for each post, which allows an authenticated user to degrade post-processing latency and consume excessive CPU on behalf of other members of any channel they share via storing an oversized notify_props.mention_keys list on their own profile.. Mattermost Advisory ID: MMSA-2026-00773
Mattermost Cloud· Oct 16, 2026
4.3Med
CVE-2026-19603 (opens in a new tab)
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the status endpoints, without being a member of that channel. Mattermost Advisory ID: MMSA-2026-00765
Mattermost Cloud· Oct 16, 2026
4.9Med
CVE-2026-19601 (opens in a new tab)
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed, which allows a System Console administrator to disclose the plaintext bind password to an attacker-controlled server via the Test Connection / diagnostics feature. Mattermost Advisory ID: MMSA-2026-00764
Mattermost Cloud· Oct 16, 2026
6.5Med
CVE-2026-19541 (opens in a new tab)
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the token URL at an attacker-controlled endpoint and triggering validation.. Mattermost Advisory ID: MMSA-2026-00761
Mattermost Cloud· Oct 16, 2026
6.4Med
CVE-2026-18795 (opens in a new tab)
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756
Mattermost Cloud· Oct 16, 2026
6.5Med
CVE-2026-18551 (opens in a new tab)
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or channel admin via a crafted PUT request to the member roles API endpoint.. Mattermost Advisory ID: MMSA-2026-00752
Mattermost Cloud· Oct 16, 2026
6.5Med
CVE-2026-108455 (opens in a new tab)
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Oct 15, 2026
6.5Med
CVE-2026-108454 (opens in a new tab)
Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Oct 15, 2026
6.5Med
CVE-2026-108453 (opens in a new tab)
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Oct 15, 2026
6.5Med
CVE-2026-108438 (opens in a new tab)
Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Oct 15, 2026
6.5Med
CVE-2026-108436 (opens in a new tab)
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Oct 15, 2026
6.5Med
CVE-2026-108435 (opens in a new tab)
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Oct 15, 2026
6.5Med
CVE-2026-108434 (opens in a new tab)
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Oct 15, 2026
6.0Med
CVE-2026-108126 (opens in a new tab)
temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext records that namespace. A caller whom the proxy authorizes only for namespace B, and who has obtained an encrypted payload from namespace A, can therefore have the proxy decrypt it. In 0.8.0, the caller can submit the payload to the codec server's /decode endpoint. In every affected version, a caller w
Temporal Cloud· Oct 15, 2026
6.1Med
CVE-2026-0320 (opens in a new tab)
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS management interface. The security risk posed by this issue is significantly minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-acc
Palo Alto Networks· Oct 14, 2026
4.9Med
CVE-2026-0319 (opens in a new tab)
An improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software enables an authenticated user to establish a GlobalProtect session using the identity of another user. Cloud NGFW and Panorama are not affected by this vulnerability.
Palo Alto Networks· Oct 14, 2026
4.6Med
CVE-2026-0318 (opens in a new tab)
A stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS® software on Panorama enables an attacker to cause a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the Panorama entering maintenance mode. Cloud NGFW, Prisma® Access, and standalone PAN-OS firewalls are not affected by this vulnerability.
Palo Alto Networks· Oct 14, 2026
5.9Med
CVE-2026-0315 (opens in a new tab)
A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges. The GlobalProtect app on Linux, Windows, iOS, Android and Chrome OS is not affected by this vulnerability.
Palo Alto Networks· Oct 14, 2026
4.3Med
CVE-2026-0314 (opens in a new tab)
A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition. The GlobalProtect™ app on Linux, macOS, iOS, Android, and Chrome OS is not affected by this vulnerability.
Palo Alto Networks· Oct 14, 2026
6.1Med
CVE-2026-0313 (opens in a new tab)
A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints.
Palo Alto Networks· Oct 14, 2026
4.3Med
CVE-2026-0312 (opens in a new tab)
Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem.
Palo Alto Networks· Oct 14, 2026
6.6Med
CVE-2026-0321 (opens in a new tab)
Denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Repeated attempts to trigger this condition result in the firewall entering maintenance mode. Cloud NGFW and Panorama are not affected by this vulnerability.
Palo Alto Networks· Oct 14, 2026
5.5Med
CVE-2026-100131 (opens in a new tab)
Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Adobe· Oct 13, 2026
5.5Med
CVE-2026-100130 (opens in a new tab)
Substance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Adobe· Oct 13, 2026
5.5Med
CVE-2026-100126 (opens in a new tab)
Bridge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Adobe· Oct 13, 2026
5.5Med
CVE-2026-103855 (opens in a new tab)
Dimension is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Adobe· Oct 13, 2026
5.5Med
CVE-2026-103853 (opens in a new tab)
Dimension is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Adobe· Oct 13, 2026
5.5Med
CVE-2026-103852 (opens in a new tab)
Substance3D - Stager is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Adobe· Oct 13, 2026
5.5Med
CVE-2026-103850 (opens in a new tab)
Substance3D - Stager is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Adobe· Oct 13, 2026
6.1Med
CVE-2026-97783 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Microsoft 365· Oct 13, 2026
6.8Med
CVE-2026-97782 (opens in a new tab)
Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.
Microsoft 365· Oct 13, 2026
6.5Med
CVE-2026-97779 (opens in a new tab)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Oct 13, 2026
6.5Med
CVE-2026-97760 (opens in a new tab)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Oct 13, 2026
5.5Med
CVE-2026-97744 (opens in a new tab)
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
Microsoft 365· Oct 13, 2026
6.5Med
CVE-2026-97743 (opens in a new tab)
Use after free in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Oct 13, 2026
6.5Med
CVE-2026-97740 (opens in a new tab)
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Oct 13, 2026
5.5Med
CVE-2026-97014 (opens in a new tab)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft 365· Oct 13, 2026
5.5Med
CVE-2026-97005 (opens in a new tab)
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.
Microsoft 365· Oct 13, 2026
4.3Med
CVE-2026-95630 (opens in a new tab)
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.
Adobe· Oct 13, 2026
6.5Med
CVE-2026-94506 (opens in a new tab)
Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Oct 13, 2026
4.6Med
CVE-2026-88209 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Oct 13, 2026
4.6Med
CVE-2026-88208 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Oct 13, 2026
6.5Med
CVE-2026-88203 (opens in a new tab)
Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Oct 13, 2026
6.5Med
CVE-2026-88201 (opens in a new tab)
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Oct 13, 2026
6.5Med
CVE-2026-88195 (opens in a new tab)
Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Oct 13, 2026
6.5Med
CVE-2026-88192 (opens in a new tab)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Oct 13, 2026
6.5Med
CVE-2026-88190 (opens in a new tab)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Oct 13, 2026

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 54 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.