CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 19 min ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 00%
High: 00%
Medium: 40100%
Low or not scored: 00%

Matching CVEs: 40; Last two years
Critical: 0; CVSS 9.0 and above
High: 0; CVSS 7.0 to 8.9
Known exploited: 1; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 18 · August 2026

Most CVEs

In each company's software, last two years

Matching CVEs

6.3Med
CVE-2026-96456 (opens in a new tab)
The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared flag on the service instance rather than per device. BlueZ passes the calling device's identity to the characteristic write handler in the options argument, but WriteValue(self, value, options) in src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py ignores options entirely. The handler t
JFrog· Sep 23, 2026
5.9Med
CVE-2026-95625 (opens in a new tab)
The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself signed or authenticated. Because the only anti-rollback check compares the manifest's version field against the current version, and that field is unsigned, an attacker who can serve a crafted manifest can force installation of any older signed release without possessing the developer's private key.
JFrog· Sep 23, 2026
6.8Med
CVE-2026-95624 (opens in a new tab)
The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check to the webview, any XSS in the app frontend can invoke this command and bypass the only anti-rollback protection the updater offers. Combined with another bug, this enables downgrade attacks without even needing to fake a higher version number.
JFrog· Sep 22, 2026
5.6Med
CVE-2026-95623 (opens in a new tab)
The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This allows an attacker who controls an allowed URL (or finds an open redirect on an allowed host) to reach disallowed destinations such as cloud metadata endpoints, localhost services, or internal network hosts.
JFrog· Sep 22, 2026
6.5Med
CVE-2026-70550 (opens in a new tab)
An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory versions.
JFrog· Aug 25, 2026
4.3Med
CVE-2026-70547 (opens in a new tab)
An authenticated user without repository read permission may access package metadata under specific conditions.
JFrog· Aug 12, 2026
5.9Med
CVE-2026-69107 (opens in a new tab)
An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.
JFrog· Aug 12, 2026
6.5Med
CVE-2026-68758 (opens in a new tab)
A low-privileged authenticated user may access restricted support information under specific conditions.
JFrog· Aug 12, 2026
5.3Med
CVE-2026-66384 (opens in a new tab)Known exploited
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
JFrog· Aug 12, 2026
6.7Med
CVE-2026-66016 (opens in a new tab)
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.
JFrog· Aug 12, 2026
5.3Med
CVE-2026-68760 (opens in a new tab)
An unauthenticated user may bypass authentication under specific cache conditions.
JFrog· Aug 12, 2026
6.6Med
CVE-2026-68756 (opens in a new tab)
A party with write access to stored session data may affect JFrog Artifactory under specific conditions.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-68755 (opens in a new tab)
A bundle writer may create misleading release promotion information under specific conditions.
JFrog· Aug 12, 2026
6.5Med
CVE-2026-68754 (opens in a new tab)
A repository publisher without delete permission may modify protected package content under specific conditions.
JFrog· Aug 12, 2026
5.3Med
CVE-2026-68753 (opens in a new tab)
An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-66382 (opens in a new tab)
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
JFrog· Aug 12, 2026
5.3Med
CVE-2026-66381 (opens in a new tab)
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-66380 (opens in a new tab)
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-66379 (opens in a new tab)
An authenticated user may view private Puppet module metadata without repository read access.
JFrog· Aug 12, 2026
4.3Med
CVE-2026-66378 (opens in a new tab)
An authenticated user without repository read permission may access private NuGet metadata under specific conditions.
JFrog· Aug 12, 2026
5.3Med
CVE-2026-66377 (opens in a new tab)
An unauthenticated user may access restricted repository information under specific conditions.
JFrog· Aug 12, 2026
5.4Med
CVE-2026-66376 (opens in a new tab)
Credentials for a deleted user may remain valid for a short period under specific conditions.
JFrog· Aug 12, 2026
6.5Med
CVE-2026-66018 (opens in a new tab)
Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets (confidentiality impact; no integrity or availability impact demonstrated).
JFrog· Jul 27, 2026
6.5Med
CVE-2026-65925 (opens in a new tab)
A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response.
JFrog· Jul 27, 2026
6.5Med
CVE-2026-65924 (opens in a new tab)
JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user - or, if anonymous access is enabled on the repository, an unauthenticated user - could cause Artifactory to issue outbound HTTP requests to arbitrary destinations and receive the response content.
JFrog· Jul 27, 2026
6.8Med
CVE-2026-65923 (opens in a new tab)
A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests. The issue primarily affects confidentiality and integrity and has been addressed in fixed Artifactory versions.
JFrog· Jul 27, 2026
5.4Med
CVE-2026-65922 (opens in a new tab)
An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level; confidentiality is not affected.
JFrog· Jul 27, 2026
6.5Med
CVE-2026-65618 (opens in a new tab)
Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data.
JFrog· Jul 27, 2026
5.5Med
CVE-2026-17534 (opens in a new tab)
Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call (for example via prompt injection) can supply a crafted public hostname that resolves to loopback or another internal address, or a public URL that redirects to such a target, and thereby reach internal network services that the denylist was intended to block. FetchURL is included in the default auto-approve tool set, so the call
JFrog· Jul 27, 2026
5.8Med
CVE-2026-25905 (opens in a new tab)
The Python code being run by 'runPython' or 'runPythonAsync' is not isolated from the rest of the JS code, allowing any Python code to use the Pyodide APIs to modify the JS environment. This may result in an attacker hijacking the MCP server - for malicious purposes including MCP tool shadowing. Note - the "mcp-run-python" project is archived and unlikely to receive a fix.
JFrog· Feb 9, 2026
5.8Med
CVE-2026-25904 (opens in a new tab)
The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python code to access the localhost interface of the host to perform SSRF attacks. Note - the "mcp-run-python" project is archived and unlikely to receive a fix.
JFrog· Feb 9, 2026
4.9Med
CVE-2025-14830 (opens in a new tab)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in JFrog Artifactory (Workers) allows Cross-Site Scripting (XSS).This issue affects Artifactory (Workers): from >=7.94.0 through <7.117.10.
JFrog· Jan 4, 2026
5.9Med
CVE-2025-12695 (opens in a new tab)
The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInterpreter” class.
JFrog· Nov 4, 2025
6.8Med
CVE-2025-6515 (opens in a new tab)
The MCP SSE endpoint in oatpp-mcp returns an instance pointer as the session ID, which is not unique nor cryptographically secure. This allows network attackers with access to the oatpp-mcp server to guess future session IDs and hijack legitimate client MCP sessions, returning malicious responses from the oatpp-mcp server.
JFrog· Oct 20, 2025
6.5Med
CVE-2025-32949 (opens in a new tab)
This vulnerability allows any authenticated user to cause the server to consume very large amounts of disk space when extracting a Zip Bomb. If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauzl library for reading the archive. The yauzl library does not contain any mechanism to detect or prevent extraction of a Zip Bomb https://en.wikipedia.org/wiki/Zip_bomb . Therefore, when using the User Import functionality with a Zip Bomb, PeerTube will try extracting the archive which will cause a disk space resource ex
JFrog· Apr 15, 2025
5.3Med
CVE-2025-32946 (opens in a new tab)
This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request, without checking if it belongs to the user.
JFrog· Apr 15, 2025
4.3Med
CVE-2025-32945 (opens in a new tab)
The vulnerability allows an existing user to add playlists to a different user’s channel using the PeerTube REST API. The vulnerable code sets the owner of the new playlist to be the user who performed the request, and then sets the associated channel to the channel ID supplied by the request, without checking if it belongs to the user.
JFrog· Apr 15, 2025
6.5Med
CVE-2025-32944 (opens in a new tab)
The vulnerability allows any authenticated user to cause the PeerTube server to stop functioning in a persistent manner. If user import is enabled (which is the default setting), any registered user can upload an archive for importing. The code uses the yauzl library for reading the archive. If the yauzl library encounters a filename that is considered illegal, it raises an exception that is uncaught by PeerTube, leading to a crash which repeats infinitely on startup.
JFrog· Apr 15, 2025
4.3Med
CVE-2025-32943 (opens in a new tab)
The vulnerability allows any authenticated user to leak the contents of arbitrary “.m3u8” files from the PeerTube server due to a path traversal in the HLS endpoint.
JFrog· Apr 15, 2025
6.5Med
CVE-2024-10524 (opens in a new tab)
Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.
JFrog· Nov 19, 2024

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 19 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.