Threat database

A TOCTOU race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host for macOS prior to version 15.83 allows a local attacker with low privileges to bypass installer package verification and install a malicious package. This can lead to local privilege escalation to root.

A command injection vulnerability exists in the desmondmorris node-tesseract package up to version 0.2.7. The flaw is in the process function of lib/tesseract.js, specifically in the Command Builder component, where manipulation of the image argument can lead to OS command injection. This vulnerability can be exploited remotely. Public exploit code has been disclosed, but the project has not yet responded or issued a fix.

A vulnerability in TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC broker. This leads to the Monitoring service executing arbitrary code with SYSTEM privileges, resulting in local privilege escalation.

A vulnerability in WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with read-only Device Monitor privileges and management CLI access to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. The written content is limited to numeric values.

An out-of-bounds write vulnerability exists in the screen-image decoder of TeamViewer Full Client for Linux and macOS versions prior to 15.83. This flaw allows a remote attacker to execute arbitrary code by sending crafted screen-image data during a remote-control session or by tricking a user into opening a malicious TeamViewer session recording (.tvs) file. Exploitation requires user interaction. The vulnerability arises from missing destination bounds checking in the decoder, leading to an out-of-bounds write to the image buffer.

A critical Cross-Site Request Forgery (CSRF) vulnerability exists in Tribulant Software Newsletters newsletters-lite versions up to 4.18.2. This flaw allows an attacker to perform unauthorized actions on behalf of an authenticated user by exploiting the lack of proper request validation.

A path traversal vulnerability exists in the Persistor._decompress function of the Model Persistor component in crownpku Rasa_NLU_Chi up to version 0.12.2. This vulnerability allows remote attackers with low privileges to manipulate file paths, potentially leading to unauthorized access or modification of files. Public exploit code is available, but no official fix or patch has been released yet.

A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to cause denial of service and potentially execute arbitrary code by returning a specially crafted response.

A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service. An attacker who can control or intercept traffic to the configured Active Directory server may exploit this by sending a specially crafted response. This can lead to denial of service and potentially arbitrary code execution. The vulnerability is critical with a CVSS 4.0 score of 9.2. No affected versions or patch information are provided.

CVE-2026-113881 is a stack-based buffer overflow vulnerability in Fireware OS's VPN Network Access Enforcement process. It allows an authenticated mobile VPN user to cause a denial of service and potentially execute arbitrary code with unprivileged process rights by sending a specially crafted request. The vulnerability has a medium severity rating with a CVSS score of 6.1. No affected versions or patch information are provided.

A vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback network traffic to obtain the user's VPN username and password because sensitive information is transmitted in cleartext.

A vulnerability in Autodesk Fusion Post Processor Utility Extension allows a maliciously crafted .stack.json file to trigger a trusted Markdown injection. This can lead to arbitrary command execution in the context of the current user.

A vulnerability in Tidewave versions from 0.8.0 before 0.9.2 allows an attacker to read filesystem path names of the application via the /tidewave/connect endpoint or the rendered toolbar. This occurs because the responses do not validate the Host header, enabling a web page that rebinds its domain to the loopback address to perform same-origin requests and access sensitive path information. The disclosed paths can reveal local usernames and project layout details. The issue has a low severity rating with a CVSS score of 2.3.

A DLL loading vulnerability exists in the TeamViewer Remote Management Monitoring installer for Windows versions prior to 26.10.1. This flaw allows a local authenticated user with low privileges to execute arbitrary code with elevated privileges, but requires user interaction to exploit.

An integer overflow vulnerability exists in the remote-control screen processing component of TeamViewer clients (Full Client, Portable, and Remote Control App) prior to version 15.83. This flaw may allow a malicious remote host to cause a denial of service or potentially execute arbitrary code with the privileges of the viewer process. Exploitation requires a user to initiate a remote-control session to an attacker-controlled or compromised host.

A vulnerability in TeamViewer Full Client and Host prior to version 15.82 for Windows allows a local authenticated user with low privileges to execute arbitrary commands as SYSTEM. This occurs due to improper access control in the installer staging directory during the installation of Advanced Asset Management. An attacker can exploit this by placing a crafted installer options file that the installer processes during service activation.

A race condition vulnerability exists in the installation process of TeamViewer Remote Management - Patch Management for Windows versions prior to 26.9.1. This flaw allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges by replacing the service executable in a temporary directory that is insufficiently protected during Patch Management activation.

A stack-based buffer overflow vulnerability exists in Fireware OS's WireGuard configuration processing. This flaw allows a remote attacker with man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud to cause a Denial of Service or potentially execute arbitrary code by tampering with a FireCloud Gateway configuration payload. The vulnerability is critical with a CVSS score of 9.5.

CVE-2026-103593 is a stack-based buffer overflow vulnerability in the Fireware OS logging service. It allows a network-adjacent attacker who can impersonate or intercept traffic to the configured log server to execute arbitrary code with root privileges by presenting a specially crafted certificate. The vulnerability has a high severity score of 7.1. No affected versions or patch information are provided.

A vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker on the cluster synchronization network segment to prematurely terminate VPN tunnels by sending crafted synchronization traffic.