CVEs.

Vulnerabilities published in the last two years in software made by the companies on the wall: clients, SDKs, agents and self-hosted editions. A CVE here does not mean the hosted service was affected or breached.

NVD data refreshed 26 min ago

Severity of matching CVEs

CVSS base severity, as scored in NVD

Critical: 401100%
High: 00%
Medium: 00%
Low or not scored: 00%

Matching CVEs: 401; Last two years
Critical: 401; CVSS 9.0 and above
High: 0; CVSS 7.0 to 8.9
Known exploited: 30; On CISA's KEV list

Matching CVEs published

By month, last two years

Peak 44 · August 2026

Most CVEs

In each company's software, last two years

Matching CVEs

9.5Crit
CVE-2026-118383 (opens in a new tab)
A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in the server terminating unexpectedly or, under certain conditions, arbitrary code execution in the context of the server process. Replica set members are affected, including the shard and config server replica set members of sharded clusters; standalone mongod instances are not.
MongoDB Atlas· Nov 10, 2026
9.1Crit
CVE-2026-120808 (opens in a new tab)
An issue exists in MongoDB's macOS TLS client implementation where certificate chain-of-trust validation is bypassed for outbound connections to IPv6-addressed peers. When a MongoDB process using the Apple SecureTransport TLS backend connects to an IPv6 target, the trust evaluation result from SecTrustEvaluate is silently discarded, regardless of whether the peer's certificate is trusted. An on-path party could exploit this by presenting a self-signed certificate containing the target's IPv6 address in the Subject Alternative Name to intercept and modify encrypted inter-node or external servic
MongoDB Atlas· Nov 10, 2026
9.6Crit
CVE-2026-108186 (opens in a new tab)
Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.
Zoom· Nov 10, 2026
9.2Crit
CVE-2026-112917 (opens in a new tab)
In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.
Docker· Nov 3, 2026
10.0Crit
CVE-2026-120338 (opens in a new tab)
Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted --allow-read, --allow-write, and --allow-net, and the runner leaves the Deno API on the JavaScript global object. Pyodide's js module proxies that global, so the Python can call Deno.readTextFileSync and Deno.writeTextFileSync. A caller who can supply the code can read and write files as the server OS
JFrog· Nov 1, 2026
9.9Crit
CVE-2026-120308 (opens in a new tab)
A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub configuration. Nothing checks that the identifier names a volume that workspace owns. Parent-directory segments in the identifier collapse the joined path to the worker's filesystem root, and the worker bind-mounts that path into the sandbox read-write unless the volume was explicitly marked read-only. A tenant with a workspace token can therefore read and write the worker's files,
JFrog· Nov 1, 2026
9.9Crit
CVE-2026-120307 (opens in a new tab)
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that mount's source with filepath.Join, which cleans parent-directory segments after the prefix check. A long enough run of those segments names any absolute path on the worker. A path that matches no mount is joined onto the container root and opened in the worker's own filesystem, so an absolute symbolic
JFrog· Nov 1, 2026
9.9Crit
CVE-2026-120306 (opens in a new tab)
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It keeps the worker pod's PID, network, IPC, and user namespaces, runs as uid 0, and holds CAP_DAC_OVERRIDE. PID 1 in that procfs is the worker entrypoint, so /proc/1/root is the worker container's filesystem and is writable. That filesystem contains the runc, buildah, and runsc binaries the worker uses to start tenant co
JFrog· Nov 1, 2026
10.0Crit
CVE-2026-65145 (opens in a new tab)
NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.
NVIDIA· Oct 27, 2026
9.0Crit
CVE-2026-84633 (opens in a new tab)
A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandbox.
Apple (iCloud, App Store and services)· Oct 26, 2026
9.8Crit
CVE-2026-84539 (opens in a new tab)
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination.
Apple (iCloud, App Store and services)· Oct 26, 2026
10.0Crit
CVE-2026-113897 (opens in a new tab)
This issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. A remote attacker may be able to break out of Web Content sandbox.
Apple (iCloud, App Store and services)· Oct 26, 2026
10.0Crit
CVE-2026-112690 (opens in a new tab)
This issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. A remote attacker may be able to break out of the WebContent sandbox.
Apple (iCloud, App Store and services)· Oct 26, 2026
9.8Crit
CVE-2026-112552 (opens in a new tab)
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker with control of a network file server may be able to cause unexpected system termination.
Apple (iCloud, App Store and services)· Oct 26, 2026
9.8Crit
CVE-2026-112526 (opens in a new tab)
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may be able to cause unexpected app termination.
Apple (iCloud, App Store and services)· Oct 26, 2026
9.3Crit
CVE-2026-112521 (opens in a new tab)
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A sandboxed process may be able to circumvent sandbox restrictions.
Apple (iCloud, App Store and services)· Oct 26, 2026
9.1Crit
CVE-2026-112514 (opens in a new tab)
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An attacker may be able to cause unexpected system termination or corrupt kernel memory.
Apple (iCloud, App Store and services)· Oct 26, 2026
9.0Crit
CVE-2026-112497 (opens in a new tab)
This issue was addressed with improved permissions checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to break out of its sandbox.
Apple (iCloud, App Store and services)· Oct 26, 2026
9.0Crit
CVE-2026-112478 (opens in a new tab)
An out-of-bounds read issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or read kernel memory.
Apple (iCloud, App Store and services)· Oct 26, 2026
9.1Crit
CVE-2026-112443 (opens in a new tab)
The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt process memory.
Apple (iCloud, App Store and services)· Oct 26, 2026
9.9Crit
CVE-2026-110720 (opens in a new tab)
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.
HashiCorp (HCP / Terraform Cloud)· Oct 26, 2026
9.2Crit
CVE-2026-111497 (opens in a new tab)Known exploited
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
Anthropic (Claude)· Oct 22, 2026
9.2Crit
CVE-2026-111497 (opens in a new tab)Known exploited
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
ClickHouse Cloud· Oct 22, 2026
10.0Crit
CVE-2026-110264 (opens in a new tab)
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.
GitLab· Oct 22, 2026
9.2Crit
CVE-2026-109619 (opens in a new tab)Known exploited
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Palo Alto Networks· Oct 21, 2026
9.2Crit
CVE-2026-109618 (opens in a new tab)Known exploited
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
Palo Alto Networks· Oct 21, 2026
9.1Crit
CVE-2026-86868 (opens in a new tab)
An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker may be able to impersonate other users.
Apple (iCloud, App Store and services)· Oct 20, 2026
9.9Crit
CVE-2026-103848 (opens in a new tab)
Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Adobe· Oct 13, 2026
9.8Crit
CVE-2026-97749 (opens in a new tab)
Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 13, 2026
9.8Crit
CVE-2026-97016 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 13, 2026
9.1Crit
CVE-2026-95631 (opens in a new tab)
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Adobe· Oct 13, 2026
9.8Crit
CVE-2026-92909 (opens in a new tab)
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.
Adobe· Oct 13, 2026
9.1Crit
CVE-2026-92464 (opens in a new tab)
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Adobe· Oct 13, 2026
9.3Crit
CVE-2026-91013 (opens in a new tab)
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Adobe· Oct 13, 2026
9.8Crit
CVE-2026-88178 (opens in a new tab)
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 13, 2026
9.8Crit
CVE-2026-88156 (opens in a new tab)
Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 13, 2026
9.8Crit
CVE-2026-70300 (opens in a new tab)
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 13, 2026
9.8Crit
CVE-2026-70291 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 13, 2026
9.8Crit
CVE-2026-70242 (opens in a new tab)
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
Microsoft 365· Oct 13, 2026
9.0Crit
CVE-2026-92892 (opens in a new tab)
Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For remediation, update to v2.128.0 or later.
JFrog· Oct 13, 2026
9.4Crit
CVE-2026-105445 (opens in a new tab)
An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticated to the registry as the recipient and could pull, push, or delete images, within its scopes, in repositories accessible to that user, including organization repositories.
Docker· Oct 13, 2026
9.1Crit
CVE-2026-65173 (opens in a new tab)
NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revocation lists. A successful exploit may lead to data tampering and denial of service.
NVIDIA· Oct 13, 2026
10.0Crit
CVE-2026-65162 (opens in a new tab)
NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings. A successful exploit may lead to code execution, privilege escalation, information disclosure, data tampering, and denial of service.
NVIDIA· Oct 13, 2026
10.0Crit
CVE-2026-97229 (opens in a new tab)Known exploited
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
GitLab· Oct 13, 2026
9.8Crit
CVE-2026-105192 (opens in a new tab)
LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapper.Deserialize, which calls pickle.loads, while the server is still decoding request arguments and before the handler runs. A single unauthenticated ZMQ DEALER message to the transport port (default 5555) therefore executes code as the user the LMCache process runs as. Official container images run that process as root. The transport binds to localhost unless t
JFrog· Oct 7, 2026
9.3Crit
CVE-2026-21589 (opens in a new tab)Known exploited
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make thi
Bitbucket· Oct 5, 2026
9.3Crit
CVE-2026-21589 (opens in a new tab)Known exploited
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make thi
Confluence· Oct 5, 2026
9.3Crit
CVE-2026-21589 (opens in a new tab)Known exploited
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make thi
Jira· Oct 5, 2026
9.3Crit
CVE-2026-21589 (opens in a new tab)Known exploited
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make thi
Jira Service Management· Oct 5, 2026
9.3Crit
CVE-2026-13043 (opens in a new tab)
A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of kernel and process memory.
WatchGuard· Oct 1, 2026

Public information only

Everything on this page was already published by the companies themselves or by public bodies. statuswall gathers it in one place, links every item to its original, and adds nothing from private or leaked sources.

Sources

National Vulnerability Database (opens in a new tab): CVE IDs, descriptions, publication dates and CVSS severity, published by the U.S. government (NIST)
CISA Known Exploited Vulnerabilities catalog (opens in a new tab): the "Known exploited" flag

How fresh it is

New and changed CVEs: pulled from NVD every two hours; last run 26 min ago
Known-exploited flags: updated from CISA in the same run
Window: the last two years; older entries drop off automatically

Source: the U.S. National Vulnerability Database, refreshed daily, with the known-exploited flag from CISA's KEV catalog. Descriptions are NVD's. A CVE is listed under a company when NVD names that company's product as affected, or when the company's own CVE authority assigned it; companies whose names are common words are matched only by explicit rules, so some CVEs will be missing. This product uses NVD data but is not endorsed or certified by the NVD. CVE is a registered trademark of The MITRE Corporation.

statuswall is independent and is not affiliated with, sponsored by or endorsed by any company named here. Company and product names are used only to identify whose public information is being referred to. The information is provided as is, for general reference, with no guarantee that it is complete, current or free of error; it is not security, legal or purchasing advice. Where this page and an official source differ, the official source is right.