CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 1 h ago

Severity mix

CVSS base severity, as scored in NVD

Critical: 4018%
High: 2,47648%
Medium: 2,00239%
Low or not scored: 2365%

CVEs: 5,115; Last two years
Critical: 401; CVSS 9.0 and above
High: 2,476; CVSS 7.0 to 8.9
Known exploited: 55; On CISA's KEV list

CVEs published

By month, last two years

Peak 834 · October 2026

Most CVEs

In each company's software, last two years

Latest CVEs

8.8High
CVE-2025-9164 (opens in a new tab)
Docker Desktop Installer.exe is vulnerable to DLL hijacking due to insecure DLL search order. The installer searches for required DLLs in the user's Downloads folder before checking system directories, allowing local privilege escalation through malicious DLL placement.This issue affects Docker Desktop: through 4.48.0.
Docker· Oct 27, 2025
6.5Med
CVE-2025-6601 (opens in a new tab)
GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1 that under certain conditions could have allowed authenticated users to gain unauthorized project access by exploiting the access request approval workflow.
GitLab· Oct 27, 2025
8.1High
CVE-2025-11989 (opens in a new tab)
GitLab has remediated an issue in GitLab EE affecting all versions from 17.6.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to execute unauthorized quick actions by including malicious commands in specific descriptions.
GitLab· Oct 27, 2025
6.5Med
CVE-2025-11974 (opens in a new tab)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to create a denial of service condition by uploading large files to specific API endpoints.
GitLab· Oct 27, 2025
6.5Med
CVE-2025-11971 (opens in a new tab)
GitLab has remediated an issue in GitLab EE affecting all versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to trigger unauthorized pipeline executions by manipulating commits.
GitLab· Oct 27, 2025
7.5High
CVE-2025-11447 (opens in a new tab)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending GraphQL requests with crafted JSON payloads.
GitLab· Oct 27, 2025
7.5High
CVE-2025-10497 (opens in a new tab)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending specially crafted payloads.
GitLab· Oct 27, 2025
9.8Crit
CVE-2025-59503 (opens in a new tab)
Server-side request forgery (ssrf) in Azure Compute Gallery allows an unauthorized attacker to elevate privileges over a network.
Microsoft Azure· Oct 23, 2025
8.8High
CVE-2025-59500 (opens in a new tab)
Improper access control in Azure Notification Service allows an authorized attacker to elevate privileges over a network.
Microsoft Azure· Oct 23, 2025
9.8Crit
CVE-2025-59273 (opens in a new tab)
Improper access control in Azure Event Grid allows an unauthorized attacker to elevate privileges over a network.
Microsoft Azure· Oct 23, 2025
8.8High
CVE-2025-12100 (opens in a new tab)
Incorrect Default Permissions vulnerability in MongoDB BI Connector ODBC driver allows Privilege Escalation.This issue affects BI Connector ODBC driver: from 1.0.0 through 1.4.6.
MongoDB Atlas· Oct 23, 2025
7.5High
CVE-2025-12044 (opens in a new tab)
Vault and Vault Enterprise (“Vault”) are vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for [+HCSEC-2025-24+|https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393] which allowed for processing JSON payloads before applying rate limits. This vulnerability, CVE-2025-12044, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.16.27, 1.19.11, 1.20.5, and 1.21.0.
HashiCorp (HCP / Terraform Cloud)· Oct 23, 2025
7.8High
CVE-2025-23352 (opens in a new tab)
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause uninitialized pointer access. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
NVIDIA· Oct 23, 2025
7.8High
CVE-2025-23347 (opens in a new tab)
NVIDIA Project G-Assist contains a vulnerability where an attacker might be able to escalate permissions. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.
NVIDIA· Oct 23, 2025
4.4Med
CVE-2025-23345 (opens in a new tab)
NVIDIA Display Driver for Windows and Linux contains a vulnerability in a video decoder, where an attacker might cause an out-of-bounds read. A successful exploit of this vulnerability might lead to information disclosure or denial of service.
NVIDIA· Oct 23, 2025
5.0Med
CVE-2025-23332 (opens in a new tab)
NVIDIA Display Driver for Linux contains a vulnerability in a kernel module, where an attacker might be able to trigger a null pointer deference. A successful exploit of this vulnerability might lead to denial of service.
NVIDIA· Oct 23, 2025
5.5Med
CVE-2025-23330 (opens in a new tab)
NVIDIA Display Driver for Linux contains a vulnerability where an attacker might be able to trigger a null pointer dereference. A successful exploit of this vulnerability might lead to denial of service.
NVIDIA· Oct 23, 2025
5.5Med
CVE-2025-23300 (opens in a new tab)
NVIDIA Display Driver for Linux contains a vulnerability in the kernel driver, where a user could cause a null pointer dereference by allocating a specific memory resource. A successful exploit of this vulnerability might lead to denial of service.
NVIDIA· Oct 23, 2025
8.1High
CVE-2025-11621 (opens in a new tab)
Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27
HashiCorp (HCP / Terraform Cloud)· Oct 23, 2025
4.3Med
CVE-2025-62401 (opens in a new tab)
An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment.
Moodle· Oct 23, 2025
6.5Med
CVE-2025-62400 (opens in a new tab)
Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information.
Moodle· Oct 23, 2025
7.5High
CVE-2025-62399 (opens in a new tab)
Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.
Moodle· Oct 23, 2025
5.4Med
CVE-2025-62398 (opens in a new tab)
A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts.
Moodle· Oct 23, 2025
5.3Med
CVE-2025-62397 (opens in a new tab)
The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.
Moodle· Oct 23, 2025
4.3Med
CVE-2025-62395 (opens in a new tab)
A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system context, revealing restricted administrative data.
Moodle· Oct 23, 2025
4.3Med
CVE-2025-62394 (opens in a new tab)
Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive quiz-related messages, leaking limited course information.
Moodle· Oct 23, 2025
4.3Med
CVE-2025-62393 (opens in a new tab)
A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details.
Moodle· Oct 23, 2025
8.8High
CVE-2025-11575 (opens in a new tab)
Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows allows Privilege Escalation.This issue affects MongoDB Atlas SQL ODBC driver: from 1.0.0 through 2.0.0.
MongoDB Atlas· Oct 23, 2025
5.3Med
CVE-2025-22178 (opens in a new tab)
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view items on the "Why" page.
Jira· Oct 22, 2025
5.3Med
CVE-2025-22177 (opens in a new tab)
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view other team overviews.
Jira· Oct 22, 2025
5.3Med
CVE-2025-22176 (opens in a new tab)
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view audit log items.
Jira· Oct 22, 2025
5.3Med
CVE-2025-22175 (opens in a new tab)
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to modify the steps of another user's private checklist.
Jira· Oct 22, 2025
5.3Med
CVE-2025-22174 (opens in a new tab)
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view portfolio rooms without the required permission.
Jira· Oct 22, 2025
5.3Med
CVE-2025-22173 (opens in a new tab)
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view certain sprint data without the required permission.
Jira· Oct 22, 2025
5.3Med
CVE-2025-22172 (opens in a new tab)
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to read external reports without the required permission.
Jira· Oct 22, 2025
5.3Med
CVE-2025-22171 (opens in a new tab)
Jira Align is vulnerable to an authorization issue. A low-privilege user is able to alter the private checklists of other users.
Jira· Oct 22, 2025
5.3Med
CVE-2025-22170 (opens in a new tab)
Jira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they included a particular state-related parameter of a user with sufficient privileges to perform the action.
Jira· Oct 22, 2025
5.3Med
CVE-2025-22169 (opens in a new tab)
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to subscribe to an item/object without having the expected permission level.
Jira· Oct 22, 2025
5.3Med
CVE-2025-22168 (opens in a new tab)
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to read the steps of another user's private checklist.
Jira· Oct 22, 2025
6.7Med
CVE-2025-23299 (opens in a new tab)
NVIDIA Bluefield and ConnectX contain a vulnerability in the management interface that could allow a malicious actor with high privilege access to execute arbitrary code.
NVIDIA· Oct 22, 2025
5.4Med
CVE-2025-11844 (opens in a new tab)
Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitization or escaping. This allows an attacker to inject malicious XPath syntax that can alter the intended query logic. The vulnerability enables attackers to bypass search filters, access unintended DOM elements, and disrupt web automation workflows. This can lead to information disclosure, manipulation
Hugging Face· Oct 22, 2025
8.7High
CVE-2025-22167 (opens in a new tab)
This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of Jira Software Data Center and Server. This Path Traversal (Arbitrary Write) vulnerability, with a CVSS Score of 8.7, allows an attacker to modify any filesystem path writable by the Jira JVM process. Atlassian recommends that Jira Software Data Center and Server customers upgrade to the latest version; if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Jira Software Data Center and Server 9.12: Upgrade to a
Jira· Oct 22, 2025
8.3High
CVE-2025-22166 (opens in a new tab)
This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS (Denial of Service) vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services of a host connected to a network. Atlassian recommends that Confluence Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Confluence Data Center and Server 8.5: Upgrade to a release great
Confluence· Oct 21, 2025
6.5Med
CVE-2025-11979 (opens in a new tab)
An authorized user may crash the MongoDB server by causing buffer over-read. This can be done by issuing a DDL operation while queries are being issued, under some conditions. This issue affects MongoDB Server v7.0 versions prior to 7.0.25, MongoDB Server v8.0 versions prior to 8.0.15, and MongoDB Server version 8.2.0.
MongoDB Atlas· Oct 20, 2025
6.8Med
CVE-2025-6515 (opens in a new tab)
The MCP SSE endpoint in oatpp-mcp returns an instance pointer as the session ID, which is not unique nor cryptographically secure. This allows network attackers with access to the oatpp-mcp server to guess future session IDs and hijack legitimate client MCP sessions, returning malicious responses from the oatpp-mcp server.
JFrog· Oct 20, 2025
6.5Med
CVE-2025-53092 (opens in a new tab)
Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting. This allows an attacker-controlled site to send credentialed requests to the Strapi backend. An attacker can exploit this by hosting a malicious site on a different origin (e.g., different port) and sending requests with credentials to the Strapi API. The vulnerability is fixe
Strapi Cloud· Oct 16, 2025
6.3Med
CVE-2025-25298 (opens in a new tab)
Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account with a password exceeding 72 bytes and later authenticate with only the first 72 bytes. This reduces the effective entropy of overlong passwords and may mislead users who believe characters beyond 72 bytes are required, creating a low likelihood of unintended authentication if an attacker can obtain or
Strapi Cloud· Oct 16, 2025
6.1Med
CVE-2025-55035 (opens in a new tab)
Mattermost Desktop App versions <=5.13.0 fail to manage modals in the Mattermost Desktop App that stops a user with a server that uses basic authentication from accessing their server which allows an attacker that provides a malicious server to the user to deny use of the Desktop App via having the user configure the malicious server and forcing a modal popup that cannot be closed.
Mattermost Cloud· Oct 16, 2025
8.2High
CVE-2024-56143 (opens in a new tab)
Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does not properly sanitize query parameters for private fields. An attacker can access private fields, including admin passwords and reset tokens, by crafting queries with the lookup parameter. This vulnerability is fixed in 5.5.2.
Strapi Cloud· Oct 16, 2025
8.1High
CVE-2025-58075 (opens in a new tab)
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the RelayState
Mattermost Cloud· Oct 16, 2025

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 1 h ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.