CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 33 min ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical
00%
High
123100%
Medium
00%
Low or not scored
00%
Matching CVEs
123
Last two years
Critical
0
CVSS 9.0 and above
High
123
CVSS 7.0 to 8.9
Known exploited
0
On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 9 · June 2025

  • Total: 116
  • December 2024: 2
  • January 2025: 1
  • February 2025: 6
  • March 2025: 5
  • April 2025: 4
  • May 2025: 6
  • June 2025: 9
  • July 2025: 1
  • August 2025: 2
  • September 2025: 8
  • October 2025: 6
  • November 2025: 1
  • December 2025: 4
  • January 2026: 4
  • February 2026: 8
  • March 2026: 8
  • April 2026: 5
  • May 2026: 6
  • June 2026: 4
  • July 2026: 2
  • August 2026: 9
  • September 2026: 7
  • October 2026: 8
  • November 2026: 0

Most CVEs

In each company's software, last two years

  1. Microsoft 365990
  2. NVIDIA590
  3. GitLab436
  4. Apple (iCloud, App Store and services)348
  5. MongoDB Atlas320
  6. Mattermost Cloud310

Matching CVEs

All servicesMicrosoft 365 990NVIDIA 590GitLab 436Apple (iCloud, App Store and services) 348MongoDB Atlas 320Mattermost Cloud 310Elastic Cloud 246Microsoft Azure 186Palo Alto Networks 184Autodesk 136JFrog 99Grafana Cloud 91Zoom 89HashiCorp (HCP / Terraform Cloud) 85Trend Micro 70Docker 65WatchGuard 61Vercel 59GitHub 56TeamViewer 47Amazon Web Services 38Hugging Face 35Anthropic (Claude) 34Salesforce 34Tenable 34Cloudflare 28Adobe 28Snowflake 23Cursor 22Temporal Cloud 21Shopify 19Canva 19LangChain / LangSmith 19Google Cloud 16Jira 14Ping Identity 13WordPress.com (Automattic) 13Webex 11Optimizely 11Metabase Cloud 10
  1. 7.1High

    CVE-2026-16255 (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when the instance-wide SAML or LDAP membership lock was enabled, an authenticated user could have granted or accepted project and group membership outside the identity provider's control, due to incomplete enforcement of the membership lock on requests created before the lock was enabled.

    GitLab· Oct 22, 2026

  2. 8.2High

    CVE-2026-15723 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.

    GitLab· Oct 22, 2026

  3. 7.5High

    CVE-2026-112212 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.

    GitLab· Oct 22, 2026

  4. 7.3High

    CVE-2026-96893 (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users, due to improper neutralization of special elements in AI conversation context construction.

    GitLab· Oct 13, 2026

  5. 8.7High

    CVE-2026-92883 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a specially crafted repository, due to improper sanitization of HTML attributes in syntax-highlighted output.

    GitLab· Oct 13, 2026

  6. 7.7High

    CVE-2026-81839 (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's privileges due to improper cleanup of scheduled pipeline execution policy records.

    GitLab· Oct 13, 2026

  7. 8.5High

    CVE-2026-16301 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.

    GitLab· Oct 13, 2026

  8. 8.2High

    CVE-2026-14814 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables, due to improper validation of repository references.

    GitLab· Oct 13, 2026

  9. 8.7High

    CVE-2026-84739 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to improper sanitization of path components in the merge request diff viewer.

    GitLab· Sep 29, 2026

  10. 7.7High

    CVE-2026-92470 (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI troubleshooting feature due to missing authorization checks.

    GitLab· Sep 24, 2026

  11. 8.5High

    CVE-2026-79708 (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their group and access protected CI/CD variables restricted to higher-privileged roles, due to insufficient scope validation.

    GitLab· Sep 16, 2026

  12. 7.5High

    CVE-2026-1168 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.

    GitLab· Sep 16, 2026

  13. 7.5High

    CVE-2025-14871 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.

    GitLab· Sep 16, 2026

  14. 8.5High

    CVE-2026-88765 (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicode conversion buffer used in Advanced Search indexing.

    GitLab· Sep 15, 2026

  15. 7.7High

    CVE-2026-13210 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input validation in the environment scope pattern matcher.

    GitLab· Sep 15, 2026

  16. 8.1High

    CVE-2026-18252 (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude agent processing configuration from a user-controlled source.

    GitLab· Aug 26, 2026

  17. 8.8High

    CVE-2026-10053 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package registry.

    GitLab· Aug 23, 2026

  18. 7.1High

    CVE-2026-19650 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling.

    GitLab· Aug 17, 2026

  19. 8.5High

    CVE-2026-19228 (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to cause AI usage to be attributed to another namespace, due to improper authorization of identity information supplied in requests.

    GitLab· Aug 12, 2026

  20. 7.1High

    CVE-2026-16494 (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a project update endpoint.

    GitLab· Aug 12, 2026

  21. 8.7High

    CVE-2026-15217 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component.

    GitLab· Aug 12, 2026

  22. 8.7High

    CVE-2026-15216 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component.

    GitLab· Aug 12, 2026

  23. 7.5High

    CVE-2026-7427 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to improper input validation.

    GitLab· Aug 12, 2026

  24. 8.5High

    CVE-2026-15423 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation.

    GitLab· Aug 12, 2026

  25. 7.5High

    CVE-2026-15975 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to insufficient resource throttling when processing merge request discussions.

    GitLab· Jul 29, 2026

  26. 8.4High

    CVE-2026-12436 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of user-supplied attributes when processing pipeline schedule inputs.

    GitLab· Jul 29, 2026

  27. 7.5High

    CVE-2026-12053 (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.1 that under certain conditions could have allowed a user to access sensitive information that had already been committed to a project, due to insufficient output filtering in Duo Workflows.

    GitLab· Jun 25, 2026

  28. 8.7High

    CVE-2026-8589 (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to add unauthorized email addresses to a targeted user's account due to improper sanitization of user-supplied input in certain group setting fields.

    GitLab· Jun 11, 2026

  29. 7.5High

    CVE-2026-7250 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper input validation in the API request parsing middleware.

    GitLab· Jun 11, 2026

  30. 8.7High

    CVE-2026-10087 (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code on behalf of a targeted user due to improper input sanitization in the Analytics Dashboard.

    GitLab· Jun 11, 2026

  31. 8.2High

    CVE-2026-4868 (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that, under certain conditions, could have allowed an authenticated user to cause specific Duo AI workflows to run under another user's identity due to improper user identity resolution when triggering Duo AI workflow runners.

    GitLab· May 27, 2026

  32. 7.5High

    CVE-2026-1659 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted requests due to insufficient input validation.

    GitLab· May 14, 2026

  33. 8.1High

    CVE-2026-1322 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with a read_api scoped OAuth application to create issues and add comments to issues in private projects due to improper authorization.

    GitLab· May 14, 2026

  34. 7.5High

    CVE-2026-1184 (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 11.9 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by uploading a specially crafted file due to improper validation.

    GitLab· May 14, 2026

  35. 7.5High

    CVE-2025-14870 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted JSON payloads due to insufficient input validation.

    GitLab· May 14, 2026

  36. 7.5High

    CVE-2025-14869 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted payloads on certain API endpoints.

    GitLab· May 14, 2026

  37. 8.1High

    CVE-2026-5816 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.4 and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session due to improper path validation under certain conditions.

    GitLab· Apr 22, 2026

  38. 8.1High

    CVE-2026-4922 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.

    GitLab· Apr 22, 2026

  39. 8.5High

    CVE-2026-5173 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to invoke unintended server-side methods through websocket connections due to improper access control.

    GitLab· Apr 8, 2026

  40. 7.5High

    CVE-2026-1092 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service due to improper input validation of JSON payloads.

    GitLab· Apr 8, 2026

  41. 7.5High

    CVE-2025-12664 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service by sending repeated GraphQL queries.

    GitLab· Apr 8, 2026

  42. 8.8High

    CVE-2026-2370 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace permissions to obtain installation credentials and impersonate the GitLab app due to improper authorization checks.

    GitLab· Mar 30, 2026

  43. 7.5High

    CVE-2026-3988 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance unresponsive due to improper input validation in GraphQL request processing.

    GitLab· Mar 25, 2026

  44. 8.8High

    CVE-2026-3857 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authenticated users due to insufficient CSRF protection.

    GitLab· Mar 25, 2026

  45. 8.1High

    CVE-2026-2745 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 7.11 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to bypass WebAuthn two-factor authentication and gain unauthorized access to user accounts due to inconsistent input validation in the authentication process.

    GitLab· Mar 25, 2026

  46. 7.5High

    CVE-2026-1724 (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to access API tokens of self-hosted AI models due to improper access control.

    GitLab· Mar 25, 2026

  47. 7.5High

    CVE-2026-1069 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by sending specially crafted GraphQL requests due to uncontrolled recursion under certain circumstances.

    GitLab· Mar 11, 2026

  48. 7.5High

    CVE-2025-14513 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service condition due to improper input validation when processing specially crafted JSON payloads in the protected branches API.

    GitLab· Mar 11, 2026

  49. 7.5High

    CVE-2025-13929 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by issuing specially crafted requests to repository archive endpoints under certain conditions.

    GitLab· Mar 11, 2026

  50. 7.5High

    CVE-2026-1725 (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting versions from 18.9 before 18.9.1 that could have under certain conditions, allowed an unauthenticated user to cause denial of service by sending specially crafted requests to a CI jobs API endpoint.

    GitLab· Feb 25, 2026

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

How fresh it is

  • New and changed CVEs: pulled from NVD every two hours; last run 33 min ago
  • Known-exploited flags: updated from CISA in the same run
  • Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.