CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 2 min ago

Severity mix

CVSS base severity, as scored in NVD

Critical: 4018%
High: 2,47648%
Medium: 2,00539%
Low or not scored: 2415%

CVEs: 5,123; Last two years
Critical: 401; CVSS 9.0 and above
High: 2,476; CVSS 7.0 to 8.9
Known exploited: 55; On CISA's KEV list

CVEs published

By month, last two years

Peak 834 · October 2026

Most CVEs

In each company's software, last two years

Latest CVEs

7.5High
CVE-2025-47866 (opens in a new tab)
An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affected installations.
Trend Micro· Jun 17, 2025
9.8Crit
CVE-2025-47865 (opens in a new tab)
A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code execution on affected installations.
Trend Micro· Jun 17, 2025
7.8High
CVE-2025-6087 (opens in a new tab)
A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /_next/image endpoint. This issue allowed attackers to load remote resources from arbitrary hosts under the victim site’s domain for any site deployed using the Cloudflare adapter for Open Next. For example: https://victim-site.com/_next/image?url=https://attacker.com In this example, attacker-controlled content from att
Cloudflare· Jun 16, 2025
7.8High
CVE-2025-36632 (opens in a new tab)
In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could execute code with SYSTEM privilege.
Tenable· Jun 16, 2025
6.9Med
CVE-2024-25573 (opens in a new tab)
Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing.
Ping Identity· Jun 15, 2025
6.9Med
CVE-2025-22854 (opens in a new tab)
Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal usage conditions.
Ping Identity· Jun 15, 2025
2.1Low
CVE-2025-21085 (opens in a new tab)
PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization.
Ping Identity· Jun 15, 2025
7.8High
CVE-2025-36633 (opens in a new tab)
In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could arbitrarily delete local system files with SYSTEM privilege, potentially leading to local privilege escalation.
Tenable· Jun 13, 2025
7.8High
CVE-2025-36631 (opens in a new tab)
In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log content at SYSTEM privilege.
Tenable· Jun 13, 2025
6.0Med
CVE-2025-4229 (opens in a new tab)
An information disclosure vulnerability in the SD-WAN feature of Palo Alto Networks PAN-OS® software enables an unauthorized user to view unencrypted data sent from the firewall through the SD-WAN interface. This requires the user to be able to intercept packets sent from the firewall. Cloud NGFW and Prisma® Access are not affected by this vulnerability.
Palo Alto Networks· Jun 13, 2025
1.0Low
CVE-2025-4227 (opens in a new tab)
An improper access control vulnerability in the Endpoint Traffic Policy Enforcement https://docs.paloaltonetworks.com/globalprotect/6-0/globalprotect-app-new-features/new-features-released-in-gp-app/endpoint-traffic-policy-enforcement feature of the Palo Alto Networks GlobalProtect™ app allows certain packets to remain unencrypted instead of being properly secured within the tunnel. An attacker with physical access to the network can inject rogue devices to intercept these packets. Under normal operating conditions, the GlobalProtect app automatically recovers from this interception within one
Palo Alto Networks· Jun 13, 2025
8.5High
CVE-2025-4232 (opens in a new tab)
An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non administrative user to escalate their privileges to root.
Palo Alto Networks· Jun 13, 2025
8.6High
CVE-2025-4231 (opens in a new tab)
A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrative user to perform actions as the root user. The attacker must have network access to the management web interface and successfully authenticate to exploit this issue. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
Palo Alto Networks· Jun 13, 2025
8.4High
CVE-2025-4230 (opens in a new tab)
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Cloud NGFW and Prisma® Access are not affected by this vulnerability.
Palo Alto Networks· Jun 13, 2025
4.6Med
CVE-2025-4228 (opens in a new tab)
An incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain files available within the Broker VM and escalate their privileges to root.
Palo Alto Networks· Jun 13, 2025
5.1Med
CVE-2025-4233 (opens in a new tab)
An insufficient implementation of cache vulnerability in Palo Alto Networks Prisma® Access Browser enables users to bypass certain data control policies.
Palo Alto Networks· Jun 12, 2025
7.5High
CVE-2025-5982 (opens in a new tab)
An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.
GitLab· Jun 12, 2025
5.9Med
CVE-2024-9512 (opens in a new tab)
An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible for private repository to be cloned in case of race condition when a secondary node is out of sync.
GitLab· Jun 12, 2025
4.3Med
CVE-2025-5195 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. It was possible for authenticated users to access arbitrary compliance frameworks, leading to unauthorized data disclosure.
GitLab· Jun 12, 2025
7.5High
CVE-2025-0673 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2, allow an attacker to trigger an infinite redirect loop, potentially leading to a denial of service condition.
GitLab· Jun 12, 2025
6.5Med
CVE-2025-5996 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 2.1.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. A lack of input validation in HTTP responses could allow an authenticated user to cause denial of service.
GitLab· Jun 12, 2025
8.7High
CVE-2025-4278 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2. Under certain conditions html injection in new search page could lead to account takeover.
GitLab· Jun 12, 2025
6.1Med
CVE-2025-2254 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper output encoding in the snipper viewer functionality lead to Cross-Site scripting attacks.
GitLab· Jun 12, 2025
7.5High
CVE-2025-1516 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 8.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper input validation in Tokens Names could be used to trigger a denial of service.
GitLab· Jun 12, 2025
7.5High
CVE-2025-1478 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input validation in Board Names could be used to trigger a denial of service.
GitLab· Jun 12, 2025
8.1High
CVE-2025-4922 (opens in a new tab)
Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14.
HashiCorp (HCP / Terraform Cloud)· Jun 11, 2025
6.6Med
CVE-2025-4605 (opens in a new tab)
A maliciously crafted .usdc file, when loaded through Autodesk Maya, can force an uncontrolled memory allocation vulnerability. A malicious actor may leverage this vulnerability to cause a denial-of-service (DoS), or cause data corruption.
Autodesk· Jun 11, 2025
4.1Med
CVE-2025-4573 (opens in a new tab)
Mattermost versions 10.7.x <= 10.7.1, 10.6.x <= 10.6.3, 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly validate LDAP group ID attributes, allowing an authenticated administrator with PermissionSysconsoleWriteUserManagementGroups permission to execute LDAP search filter injection via the PUT /api/v4/ldap/groups/{remote_id}/link API when objectGUID is configured as the Group ID Attribute.
Mattermost Cloud· Jun 11, 2025
4.3Med
CVE-2025-4128 (opens in a new tab)
Mattermost versions 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly restrict API access to team information, allowing guest users to bypass permissions and view information about public teams they are not members of via a direct API call to /api/v4/teams/{team_id}.
Mattermost Cloud· Jun 11, 2025
8.4High
CVE-2025-32717 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 11, 2025
8.4High
CVE-2025-47957 (opens in a new tab)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
8.4High
CVE-2025-47953 (opens in a new tab)
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
7.8High
CVE-2025-47176 (opens in a new tab)
'.../...//' in Microsoft Office Outlook allows an authorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
7.8High
CVE-2025-47175 (opens in a new tab)
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
7.8High
CVE-2025-47174 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
7.8High
CVE-2025-47173 (opens in a new tab)
Improper input validation in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
8.8High
CVE-2025-47172 (opens in a new tab)
Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Jun 10, 2025
6.7Med
CVE-2025-47171 (opens in a new tab)
Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
7.8High
CVE-2025-47170 (opens in a new tab)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
7.8High
CVE-2025-47169 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
7.8High
CVE-2025-47168 (opens in a new tab)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
8.4High
CVE-2025-47167 (opens in a new tab)
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
8.8High
CVE-2025-47166 (opens in a new tab)
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Jun 10, 2025
7.8High
CVE-2025-47165 (opens in a new tab)
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
8.4High
CVE-2025-47164 (opens in a new tab)
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
8.8High
CVE-2025-47163 (opens in a new tab)
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Jun 10, 2025
8.4High
CVE-2025-47162 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Jun 10, 2025
8.8High
CVE-2024-43706 (opens in a new tab)
Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.
Elastic Cloud· Jun 10, 2025
7.8High
CVE-2025-5335 (opens in a new tab)
A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized in the Autodesk Installer application. Exploitation of this vulnerability may lead to code execution.
Autodesk· Jun 10, 2025
7.5High
CVE-2025-43701 (opens in a new tab)
Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of Custom Settings data. This impacts OmniStudio: before version 254.
Salesforce· Jun 10, 2025

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 2 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.