CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 1 h ago

Severity mix

CVSS base severity, as scored in NVD

Critical: 4018%
High: 2,47648%
Medium: 2,00539%
Low or not scored: 2415%

CVEs: 5,123; Last two years
Critical: 401; CVSS 9.0 and above
High: 2,476; CVSS 7.0 to 8.9
Known exploited: 55; On CISA's KEV list

CVEs published

By month, last two years

Peak 834 · October 2026

Most CVEs

In each company's software, last two years

Latest CVEs

7.8High
CVE-2025-29820 (opens in a new tab)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Apr 8, 2025
7.5High
CVE-2025-29816 (opens in a new tab)
Improper input validation in Microsoft Office Word allows an unauthorized attacker to bypass a security feature over a network.
Microsoft 365· Apr 8, 2025
7.5High
CVE-2025-29805 (opens in a new tab)
Exposure of sensitive information to an unauthorized actor in Outlook for Android allows an unauthorized attacker to disclose information over a network.
Microsoft 365· Apr 8, 2025
8.8High
CVE-2025-29794 (opens in a new tab)
Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Apr 8, 2025
7.2High
CVE-2025-29793 (opens in a new tab)
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Microsoft 365· Apr 8, 2025
7.3High
CVE-2025-29792 (opens in a new tab)
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
Microsoft 365· Apr 8, 2025
7.8High
CVE-2025-29791 (opens in a new tab)
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Apr 8, 2025
7.8High
CVE-2025-27752 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Apr 8, 2025
7.8High
CVE-2025-27751 (opens in a new tab)
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Apr 8, 2025
7.8High
CVE-2025-27750 (opens in a new tab)
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Microsoft 365· Apr 8, 2025
7.8High
CVE-2025-27749 (opens in a new tab)
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Apr 8, 2025
7.8High
CVE-2025-27748 (opens in a new tab)
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Apr 8, 2025
7.8High
CVE-2025-27747 (opens in a new tab)
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Microsoft 365· Apr 8, 2025
7.8High
CVE-2025-27746 (opens in a new tab)
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Apr 8, 2025
7.8High
CVE-2025-27745 (opens in a new tab)
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Apr 8, 2025
7.8High
CVE-2025-27744 (opens in a new tab)
Improper access control in Microsoft Office allows an authorized attacker to elevate privileges locally.
Microsoft 365· Apr 8, 2025
7.8High
CVE-2025-27489 (opens in a new tab)
Improper input validation in Azure Local allows an authorized attacker to elevate privileges locally.
Microsoft Azure· Apr 8, 2025
7.5High
CVE-2025-26687 (opens in a new tab)
Use after free in Windows Win32K - GRFX allows an unauthorized attacker to elevate privileges over a network.
Microsoft 365· Apr 8, 2025
7.8High
CVE-2025-26642 (opens in a new tab)
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
Microsoft 365· Apr 8, 2025
5.5Med
CVE-2025-26628 (opens in a new tab)
Insufficiently protected credentials in Azure Local Cluster allows an authorized attacker to disclose information locally.
Microsoft Azure· Apr 8, 2025
5.7Med
CVE-2025-25002 (opens in a new tab)
Insertion of sensitive information into log file in Azure Local Cluster allows an authorized attacker to disclose information over an adjacent network.
Microsoft Azure· Apr 8, 2025
6.5Med
CVE-2025-30671 (opens in a new tab)
Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.
Zoom· Apr 8, 2025
6.5Med
CVE-2025-30670 (opens in a new tab)
Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.
Zoom· Apr 8, 2025
5.5Med
CVE-2025-27443 (opens in a new tab)
Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrity via local access.
Zoom· Apr 8, 2025
5.2Med
CVE-2025-27442 (opens in a new tab)
Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access.
Zoom· Apr 8, 2025
5.2Med
CVE-2025-27441 (opens in a new tab)
Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access.
Zoom· Apr 8, 2025
7.5High
CVE-2024-52981 (opens in a new tab)
An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.
Elastic Cloud· Apr 8, 2025
6.5Med
CVE-2024-52980 (opens in a new tab)
A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash. A successful attack requires a malicious user to have read_pipeline Elasticsearch cluster privilege assigned to them.
Elastic Cloud· Apr 8, 2025
6.5Med
CVE-2024-52974 (opens in a new tab)
An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permissions for Observability assigned to them.
Elastic Cloud· Apr 8, 2025
7.5High
CVE-2025-32031 (opens in a new tab)
Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically due to internal optimizations being frequently bypassed. The query planner includes an optimization that significantly speeds up planning for applicable GraphQL selections. However, queries with deeply nested and reused named fragments can generate many selections where this optimization does not apply, leading to si
Apollo GraphOS· Apr 7, 2025
7.5High
CVE-2025-32030 (opens in a new tab)
Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically during named fragment expansion. Named fragments were being expanded once per fragment spread during query planning, leading to exponential resource usage when deeply nested and reused fragments were involved. This could lead to excessive resource consumption and denial of service. This has been remediated in @apollo
Apollo GraphOS· Apr 7, 2025
6.9Med
CVE-2025-2245 (opens in a new tab)
A server-side request forgery (SSRF) vulnerability exists in the Bitdefender GravityZone Update Server when operating in Relay Mode. The HTTP proxy component on port 7074 uses a domain allowlist to restrict outbound requests, but fails to properly sanitize hostnames containing null-byte (%00) sequences. By crafting a request to a domain such as evil.com%00.bitdefender.com, an attacker can bypass the allowlist check, causing the proxy to forward requests to arbitrary external or internal systems.
Bitdefender GravityZone· Apr 4, 2025
9.5Crit
CVE-2025-2244 (opens in a new tab)
A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-supplied input without validation. By crafting a malicious serialized payload, an attacker can trigger PHP object injection, perform a file write, and gain arbitrary command execution on the host system.
Bitdefender GravityZone· Apr 4, 2025
6.9Med
CVE-2025-2243 (opens in a new tab)
A server-side request forgery (SSRF) vulnerability in Bitdefender GravityZone Console allows an attacker to bypass input validation logic using leading characters in DNS requests. Paired with other potential vulnerabilities, this bypass could be used for execution of third party code. This issue affects GravityZone Console: before 6.41.2.1.
Bitdefender GravityZone· Apr 4, 2025
1.7Low
CVE-2025-30218 (opens in a new tab)
Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host as the Next.js application. Initiating a fetch request to a third-party within Middleware will send the x-middleware-subrequest-id to that third party. This vulnerability is fixed in 12.3.6, 13.5.10, 14.2.26, and 15.2.4.
Vercel· Apr 2, 2025
9.0Crit
CVE-2025-31286 (opens in a new tab)
An HTML injection vulnerability previously discovered in Trend Vision One could have allowed a malicious user to execute arbitrary code. Please note: this issue has already been addressed on the backend service and is no longer considered an active vulnerability.
Trend Micro· Apr 2, 2025
7.2High
CVE-2025-31285 (opens in a new tab)
A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability.
Trend Micro· Apr 2, 2025
7.2High
CVE-2025-31284 (opens in a new tab)
A broken access control vulnerability previously discovered in the Trend Vision One Status component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability.
Trend Micro· Apr 2, 2025
7.2High
CVE-2025-31283 (opens in a new tab)
A broken access control vulnerability previously discovered in the Trend Vision One User Roles component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability.
Trend Micro· Apr 2, 2025
7.2High
CVE-2025-31282 (opens in a new tab)
A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is no longer considered an active vulnerability.
Trend Micro· Apr 2, 2025
7.8High
CVE-2025-1660 (opens in a new tab)
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
Autodesk· Apr 1, 2025
7.8High
CVE-2025-1659 (opens in a new tab)
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Autodesk· Apr 1, 2025
7.8High
CVE-2025-1658 (opens in a new tab)
A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
Autodesk· Apr 1, 2025
9.8Crit
CVE-2025-3085 (opens in a new tab)
A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the intermediate certificates in the peer's certificate chain. In cases of MONGODB-X509, which is not enabled by default, this may lead to improper authentication. This issue may also affect intra-cluster authentication. This issue affects MongoDB Server v5.0 versions prior to 5.0.31, MongoDB Server v6.0 versions prior to 6.0.20, MongoDB Server v7.0 versions prior to 7.0.16 and MongoDB Server v8.0 versions prior to 8.0.4. Required Configuratio
MongoDB Atlas· Apr 1, 2025
6.5Med
CVE-2025-3084 (opens in a new tab)
When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. This affects MongoDB Server v5.0 prior to 5.0.31, MongoDB Server v6.0 prior to 6.0.20, MongoDB Server v7.0 prior to 7.0.16 and MongoDB Server v8.0 prior to 8.0.4
MongoDB Atlas· Apr 1, 2025
7.5High
CVE-2025-3083 (opens in a new tab)
Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31, MongoDB v6.0 versions prior to 6.0.20 and MongoDB v7.0 versions prior to 7.0.16
MongoDB Atlas· Apr 1, 2025
5.4Med
CVE-2025-3082 (opens in a new tab)
A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.20, MongoDB Server v7.0 version prior to 7.0.14 and MongoDB Server v7.3 versions prior to 7.3.4.
MongoDB Atlas· Apr 1, 2025
8.8High
CVE-2025-21384 (opens in a new tab)
An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network.
Microsoft Azure· Apr 1, 2025
9.8Crit
CVE-2025-26683 (opens in a new tab)
Improper authorization in Azure Playwright allows an unauthorized attacker to elevate privileges over a network.
Microsoft Azure· Mar 31, 2025
6.5Med
CVE-2024-12619 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1, allowing internal users to gain unauthorized access to internal projects.
GitLab· Mar 28, 2025

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 1 h ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.