CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 41 min ago

Severity mix

CVSS base severity, as scored in NVD

Critical: 4018%
High: 2,47648%
Medium: 2,00239%
Low or not scored: 2365%

CVEs: 5,115; Last two years
Critical: 401; CVSS 9.0 and above
High: 2,476; CVSS 7.0 to 8.9
Known exploited: 55; On CISA's KEV list

CVEs published

By month, last two years

Peak 834 · October 2026

Most CVEs

In each company's software, last two years

Latest CVEs

8.7High
CVE-2025-64755 (opens in a new tab)
Claude Code is an agentic coding tool. Prior to version 2.0.31, due to an error in sed command parsing, it was possible to bypass the Claude Code read-only validation and write to arbitrary files on the host system. This issue has been patched in version 2.0.31.
Anthropic (Claude)· Nov 21, 2025
9.8Crit
CVE-2025-62207 (opens in a new tab)
Azure Monitor Elevation of Privilege Vulnerability
Microsoft Azure· Nov 20, 2025
9.8Crit
CVE-2025-59245 (opens in a new tab)
Microsoft SharePoint Online Elevation of Privilege Vulnerability
Microsoft 365· Nov 20, 2025
10.0Crit
CVE-2025-49752 (opens in a new tab)
Azure Bastion Elevation of Privilege Vulnerability
Microsoft Azure· Nov 20, 2025
7.7High
CVE-2025-65099 (opens in a new tab)
Claude Code is an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above, Claude Code could have been tricked to execute code contained in a project via yarn plugins before the user accepted the startup trust dialog. Exploiting this would have required a user to start Claude Code in an untrusted directory and to be using Yarn 3.0 or above. This issue has been patched in version 1.0.39.
Anthropic (Claude)· Nov 19, 2025
6.9Med
CVE-2025-12119 (opens in a new tab)
A mongoc_bulk_operation_t may read invalid memory if large options are passed.
MongoDB Atlas· Nov 18, 2025
7.8High
CVE-2025-33184 (opens in a new tab)
NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component, where an attacker could cause a code injection issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
NVIDIA· Nov 18, 2025
7.8High
CVE-2025-33183 (opens in a new tab)
NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component, where an attacker could cause a code injection issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
NVIDIA· Nov 18, 2025
3.5Low
CVE-2025-55074 (opens in a new tab)
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to enforce access permissions on the Agents plugin which allows other users to determine when users had read channels via channel member objects
Mattermost Cloud· Nov 18, 2025
6.5Med
CVE-2025-12983 (opens in a new tab)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to cause a denial of service condition by submitting specially crafted markdown content with nested formatting patterns.
GitLab· Nov 15, 2025
4.3Med
CVE-2025-7736 (opens in a new tab)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to bypass access control restrictions and view GitLab Pages content intended only for project members by authenticating through OAuth providers.
GitLab· Nov 15, 2025
4.3Med
CVE-2025-7000 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 17.6 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that, under specific conditions, could have allowed unauthorized users to view confidential branch names by accessing project issues with related merge requests.
GitLab· Nov 15, 2025
3.5Low
CVE-2025-6945 (opens in a new tab)
GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to leak sensitive information from confidential issues by injecting hidden prompts into merge request comments.
GitLab· Nov 15, 2025
4.3Med
CVE-2025-6171 (opens in a new tab)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker with reporter access to view branch names and pipeline details by accessing the packages API endpoint even when repository access was disabled.
GitLab· Nov 15, 2025
6.5Med
CVE-2025-2615 (opens in a new tab)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that could have allowed a blocked user to access sensitive information by establishing GraphQL subscriptions through WebSocket connections.
GitLab· Nov 15, 2025
3.5Low
CVE-2025-11990 (opens in a new tab)
GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to gain CSRF tokens by exploiting improper input validation in repository references combined with redirect handling weaknesses.
GitLab· Nov 15, 2025
5.3Med
CVE-2025-11865 (opens in a new tab)
An issue has been discovered in GitLab EE affecting all versions from 18.1 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that, under certain circumstances, could have allowed an attacker to remove Duo flows of another user.
GitLab· Nov 15, 2025
4.4Med
CVE-2025-4618 (opens in a new tab)
A sensitive information disclosure vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to retrieve sensitive data from Prisma Browser. Browser self-protection should be enabled to mitigate this issue.
Palo Alto Networks· Nov 14, 2025
1.1Low
CVE-2025-4617 (opens in a new tab)
An insufficient policy enforcement vulnerability in Palo Alto Networks Prisma® Browser on Windows allows a locally authenticated non-admin user to bypass the screenshot control feature of the browser. Browser self-protection should be enabled to mitigate this issue.
Palo Alto Networks· Nov 14, 2025
1.1Low
CVE-2025-4616 (opens in a new tab)
An insufficient validation of an untrusted input vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to revert the browser’s security controls.
Palo Alto Networks· Nov 14, 2025
4.9Med
CVE-2025-11794 (opens in a new tab)
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to sanitize user data which allows system administrators to access password hashes and MFA secrets via the POST /api/v4/users/{user_id}/email/verify/member endpoint
Mattermost Cloud· Nov 14, 2025
5.3Med
CVE-2025-55073 (opens in a new tab)
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to validate the relationship between the post being updated and the MSTeams plugin OAuth flow which allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL.
Mattermost Cloud· Nov 14, 2025
7.5High
CVE-2025-55070 (opens in a new tab)
Mattermost versions <11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events
Mattermost Cloud· Nov 14, 2025
4.3Med
CVE-2025-41436 (opens in a new tab)
Mattermost versions <11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via the "Open in Channel" functionality from followed threads
Mattermost Cloud· Nov 14, 2025
4.3Med
CVE-2025-11776 (opens in a new tab)
Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the `/api/v4/teams/{team_id}/channels/search_archived` endpoint
Mattermost Cloud· Nov 14, 2025
6.6Med
CVE-2025-4619 (opens in a new tab)
A denial-of-service (DoS) vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to reboot a firewall by sending a specially crafted packet through the dataplane. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode. This issue is applicable to the PAN-OS software versions listed below on PA-Series firewalls, VM-Series firewalls, and Prisma® Access software. This issue does not affect Cloud NGFW. We have successfully completed the Prisma Access upgrade for all customers, with the exception of those facing issues such as conflic
Palo Alto Networks· Nov 13, 2025
6.5Med
CVE-2025-59480 (opens in a new tab)
Mattermost Mobile Apps versions <=2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious Mattermost instance or on-path attacker to obtain user session credentials via crafted token-in-URL responses
Mattermost Cloud· Nov 13, 2025
4.3Med
CVE-2025-11777 (opens in a new tab)
Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11 fail to properly validate team membership permissions in the Add Channel Member API which allows users from one team to access user metadata and channel membership information from other teams via the API endpoint
Mattermost Cloud· Nov 13, 2025
9.8Crit
CVE-2025-62484 (opens in a new tab)
Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access.
Zoom· Nov 13, 2025
9.8Crit
CVE-2025-64741 (opens in a new tab)
Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access.
Zoom· Nov 13, 2025
7.8High
CVE-2025-64740 (opens in a new tab)
Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user to conduct an escalation of privilege via local access.
Zoom· Nov 13, 2025
7.5High
CVE-2025-64739 (opens in a new tab)
External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access.
Zoom· Nov 13, 2025
5.5Med
CVE-2025-64738 (opens in a new tab)
External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclosure of information via local access.
Zoom· Nov 13, 2025
7.5High
CVE-2025-62483 (opens in a new tab)
Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a disclosure of information via network access.
Zoom· Nov 13, 2025
6.1Med
CVE-2025-62482 (opens in a new tab)
Cross-site scripting in Zoom Workplace for Windows before version 6.5.10 may allow an unauthenticated user to impact integrity via network access.
Zoom· Nov 13, 2025
6.5Med
CVE-2025-30669 (opens in a new tab)
Improper certificate validation in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via adjacent access.
Zoom· Nov 13, 2025
6.5Med
CVE-2025-30662 (opens in a new tab)
Symlink following in the installer for the Zoom Workplace VDI Plugin macOS Universal installer before version 6.3.14, 6.4.14, and 6.5.10 in their respective tracks may allow an authenticated user to conduct a disclosure of information via network access.
Zoom· Nov 13, 2025
7.8High
CVE-2025-11797 (opens in a new tab)
A maliciously crafted DWG file, when parsed through Autodesk 3ds Max, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Autodesk· Nov 12, 2025
7.8High
CVE-2025-11795 (opens in a new tab)
A maliciously crafted JPG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Autodesk· Nov 12, 2025
4.3Med
CVE-2025-37734 (opens in a new tab)
Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.
Elastic Cloud· Nov 12, 2025
2.1Low
CVE-2025-41116 (opens in a new tab)
When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is not authorized being returned. This issue affects Grafana Databricks Datasource Plugin: from 1.6.0 before 1.12.0
Grafana Cloud· Nov 11, 2025
2.1Low
CVE-2025-3717 (opens in a new tab)
When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is not authorized being returned. This issue affects Grafana Snowflake Datasource Plugin: from 1.5.0 before 1.14.1.
Grafana Cloud· Nov 11, 2025
7.8High
CVE-2025-62216 (opens in a new tab)
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Nov 11, 2025
8.7High
CVE-2025-62211 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Nov 11, 2025
8.7High
CVE-2025-62210 (opens in a new tab)
Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.
Microsoft 365· Nov 11, 2025
6.5Med
CVE-2025-62206 (opens in a new tab)
Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Nov 11, 2025
7.8High
CVE-2025-62205 (opens in a new tab)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Nov 11, 2025
8.0High
CVE-2025-62204 (opens in a new tab)
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Nov 11, 2025
7.8High
CVE-2025-62203 (opens in a new tab)
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Nov 11, 2025
7.1High
CVE-2025-62202 (opens in a new tab)
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Microsoft 365· Nov 11, 2025

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 41 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.