CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 43 min ago

Severity mix

CVSS base severity, as scored in NVD

Critical: 4018%
High: 2,47648%
Medium: 2,00639%
Low or not scored: 2415%

CVEs: 5,124; Last two years
Critical: 401; CVSS 9.0 and above
High: 2,476; CVSS 7.0 to 8.9
Known exploited: 55; On CISA's KEV list

CVEs published

By month, last two years

Peak 834 · October 2026

Most CVEs

In each company's software, last two years

Latest CVEs

7.8High
CVE-2025-5046 (opens in a new tab)
A maliciously crafted DGN file, when linked or imported into Autodesk AutoCAD, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Autodesk· Aug 15, 2025
9.8Crit
CVE-2025-8943 (opens in a new tab)
The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). Furthermore, in Flowise versions before 3.0.1 the default installation operates without authentication unless explicitly configured. This combination allows unauthenticated network attackers to execute unsandboxed OS commands.
JFrog· Aug 14, 2025
9.8Crit
CVE-2025-55346 (opens in a new tab)
User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request.
JFrog· Aug 14, 2025
6.5Med
CVE-2025-8770 (opens in a new tab)
An issue has been discovered in GitLab EE affecting all versions from 18.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that could have allowed authenticated users with specific access to bypass merge request approval policies by manipulating approval rule identifiers.
GitLab· Aug 13, 2025
5.4Med
CVE-2025-7739 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 18.2 before 18.2.2 that, under certain conditions, could have allowed authenticated users to achieve stored cross-site scripting by injecting malicious HTML content in scoped label descriptions.
GitLab· Aug 13, 2025
5.4Med
CVE-2025-7734 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 14.2 before 18.0.6, 18.1 before 18.1.4 and 18.2 before 18.2.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content.
GitLab· Aug 13, 2025
5.4Med
CVE-2025-6186 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to achieve account takeover by injecting malicious HTML into work item names.
GitLab· Aug 13, 2025
5.0Med
CVE-2025-5819 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 15.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users with developer access to obtain ID tokens for protected branches under certain circumstances.
GitLab· Aug 13, 2025
6.5Med
CVE-2025-2937 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 13.2 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to create a denial of service condition by sending specially crafted markdown payloads to the Wiki feature.
GitLab· Aug 13, 2025
6.5Med
CVE-2025-2614 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed an authenticated user to cause a denial of service condition by creating specially crafted content that consumes excessive server resources when processed.
GitLab· Aug 13, 2025
4.3Med
CVE-2025-2498 (opens in a new tab)
An improper access control in Gitlab EE affecting all versions from 12.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that under certain conditions could have allowed users to view assigned issues from restricted groups by bypassing IP restrictions.
GitLab· Aug 13, 2025
7.8High
CVE-2025-23306 (opens in a new tab)
NVIDIA Megatron-LM for all platforms contains a vulnerability in the megatron/training/ arguments.py component where an attacker could cause a code injection issue by providing a malicious input. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.
NVIDIA· Aug 13, 2025
7.8High
CVE-2025-23305 (opens in a new tab)
NVIDIA Megatron-LM for all platforms contains a vulnerability in the tools component, where an attacker may exploit a code injection issue. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.
NVIDIA· Aug 13, 2025
9.8Crit
CVE-2025-23304 (opens in a new tab)
NVIDIA NeMo library for all platforms contains a vulnerability in the model loading component, where an attacker could cause code injection by loading .nemo files with maliciously crafted metadata. A successful exploit of this vulnerability may lead to remote code execution and data tampering.
NVIDIA· Aug 13, 2025
9.8Crit
CVE-2025-23303 (opens in a new tab)
NVIDIA NeMo Framework for all platforms contains a vulnerability where a user could cause a deserialization of untrusted data by remote code execution. A successful exploit of this vulnerability might lead to code execution and data tampering.
NVIDIA· Aug 13, 2025
7.8High
CVE-2025-23298 (opens in a new tab)
NVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability in a python dependency, where an attacker could cause a code injection issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
NVIDIA· Aug 13, 2025
7.8High
CVE-2025-23296 (opens in a new tab)
NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component where an attacker could cause a code injection issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
NVIDIA· Aug 13, 2025
7.8High
CVE-2025-23295 (opens in a new tab)
NVIDIA Apex for all platforms contains a vulnerability in a Python component where an attacker could cause a code injection issue by providing a malicious file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.
NVIDIA· Aug 13, 2025
7.8High
CVE-2025-23294 (opens in a new tab)
NVIDIA WebDataset for all platforms contains a vulnerability where an attacker could execute arbitrary code with elevated permissions. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, information disclosure, and denial of service.
NVIDIA· Aug 13, 2025
7.5High
CVE-2025-1477 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 8.14 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed an unauthenticated user to create a denial of service condition by sending specially crafted payloads to specific integration API endpoints.
GitLab· Aug 13, 2025
5.5Med
CVE-2024-12303 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain conditions could have allowed authenticated users with specific roles and permissions to delete issues including confidential ones by inviting users with a specific role.
GitLab· Aug 13, 2025
6.5Med
CVE-2024-10219 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 15.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain conditions could have allowed authenticated users to bypass access controls and download private artifacts by accessing specific API endpoints.
GitLab· Aug 13, 2025
5.3Med
CVE-2025-2184 (opens in a new tab)
A credential management flaw in Palo Alto Networks Cortex XDR® Broker VM causes different Broker VM images to share identical default credentials for internal services. Users knowing these default credentials could access internal services on other Broker VM installations. The attacker must have network access to the Broker VM to exploit this issue.
Palo Alto Networks· Aug 13, 2025
5.3Med
CVE-2025-2183 (opens in a new tab)
An insufficient certificate validation issue in the Palo Alto Networks GlobalProtect™ app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint.
Palo Alto Networks· Aug 13, 2025
5.6Med
CVE-2025-2182 (opens in a new tab)
A problem with the implementation of the MACsec protocol in Palo Alto Networks PAN-OS® results in the cleartext exposure of the connectivity association key (CAK). This issue is only applicable to PA-7500 Series devices which are in an NGFW cluster. A user who possesses this key can read messages being sent between devices in a NGFW Cluster. There is no impact in non-clustered firewalls or clusters of firewalls that do not enable MACsec.
Palo Alto Networks· Aug 13, 2025
5.9Med
CVE-2025-2181 (opens in a new tab)
A sensitive information disclosure vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can result in the cleartext exposure of Prisma Cloud access keys in Checkov's output.
Palo Alto Networks· Aug 13, 2025
4.8Med
CVE-2025-2180 (opens in a new tab)
An unsafe deserialization vulnerability in Palo Alto Networks Checkov by Prisma® Cloud allows an authenticated user to execute arbitrary code as a non administrative user by scanning a malicious terraform file when using Checkov in Prisma® Cloud. This issue impacts Checkov 3.0 versions earlier than Checkov 3.2.415.
Palo Alto Networks· Aug 13, 2025
8.8High
CVE-2025-55345 (opens in a new tab)
Using Codex CLI in workspace-write mode inside a malicious context (repo, directory, etc) could lead to arbitrary file overwrite and potentially remote code execution due to symlinks being followed outside the allowed current working directory.
JFrog· Aug 13, 2025
8.8High
CVE-2025-49457 (opens in a new tab)
Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access
Zoom· Aug 12, 2025
5.1Med
CVE-2025-49456 (opens in a new tab)
Race condition in the installer for certain Zoom Clients for Windows may allow an unauthenticated user to impact application integrity via local access.
Zoom· Aug 12, 2025
7.5High
CVE-2025-53793 (opens in a new tab)
Improper authentication in Azure Stack allows an unauthorized attacker to disclose information over a network.
Microsoft Azure· Aug 12, 2025
8.4High
CVE-2025-53784 (opens in a new tab)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Aug 12, 2025
7.5High
CVE-2025-53783 (opens in a new tab)
Heap-based buffer overflow in Microsoft Teams allows an unauthorized attacker to execute code over a network.
Microsoft 365· Aug 12, 2025
9.8Crit
CVE-2025-53766 (opens in a new tab)
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
Microsoft 365· Aug 12, 2025
5.5Med
CVE-2025-53765 (opens in a new tab)
Exposure of private personal information to an unauthorized actor in Azure Stack allows an authorized attacker to disclose information locally.
Microsoft Azure· Aug 12, 2025
7.8High
CVE-2025-53761 (opens in a new tab)
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
Microsoft 365· Aug 12, 2025
7.1High
CVE-2025-53760 (opens in a new tab)
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Microsoft 365· Aug 12, 2025
7.8High
CVE-2025-53759 (opens in a new tab)
Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Aug 12, 2025
7.8High
CVE-2025-53741 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Aug 12, 2025
8.4High
CVE-2025-53740 (opens in a new tab)
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Aug 12, 2025
7.8High
CVE-2025-53739 (opens in a new tab)
Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Aug 12, 2025
7.8High
CVE-2025-53738 (opens in a new tab)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Aug 12, 2025
7.8High
CVE-2025-53737 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Aug 12, 2025
6.2Med
CVE-2025-53736 (opens in a new tab)
Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
Microsoft 365· Aug 12, 2025
7.8High
CVE-2025-53735 (opens in a new tab)
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Aug 12, 2025
7.8High
CVE-2025-53734 (opens in a new tab)
Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally.
Microsoft 365· Aug 12, 2025
8.4High
CVE-2025-53733 (opens in a new tab)
Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Aug 12, 2025
7.8High
CVE-2025-53732 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Aug 12, 2025
8.4High
CVE-2025-53731 (opens in a new tab)
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Aug 12, 2025
7.8High
CVE-2025-53730 (opens in a new tab)
Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally.
Microsoft 365· Aug 12, 2025

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 43 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.