Threats affecting pkg:generic/hunspell

Adobe Campaign Classic (ACC) suffers from a critical SQL Injection vulnerability that allows a low-privileged attacker to execute arbitrary code without user interaction. This vulnerability affects the scope of the application and can lead to complete compromise of confidentiality, integrity, and availability.

Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability (CVE-2026-104350). This vulnerability allows an attacker to inject malicious scripts into web pages viewed by victims, potentially leading to elevated access or control over the victim's account or session. Exploitation requires user interaction, such as visiting a crafted URL or interacting with a compromised page. The vulnerability has a critical severity with a CVSS score of 9.3.

A local privilege escalation vulnerability exists in Veeam Agent for Linux when managed by a Veeam Backup & Replication instance. This flaw allows a user with limited privileges to escalate their rights on the affected system. The vulnerability is rated high severity with a CVSS score of 7.3. No specific affected versions or patches are detailed in the available information.

A stored cross-site scripting (XSS) vulnerability exists in the Autodesk Fusion desktop application due to a maliciously crafted HTML payload embedded in the description of an electronic library (.lbr) file. When such a library is imported and its description displayed in the Library Manager, the payload can execute arbitrary code or read local files within the context of the application process. This vulnerability has a high severity rating with a CVSS score of 7.1.

Adobe Campaign Classic (ACC) contains an OS Command Injection vulnerability (CWE-78) that allows a low-privileged attacker to execute arbitrary code without user interaction. The vulnerability affects the context of the current user and changes the security scope. It has a critical severity with a CVSS score of 9.9.

Adobe Campaign Classic (ACC) is affected by a critical SQL Injection vulnerability (CWE-89) that allows an attacker with high privileges to execute arbitrary code without user interaction. The vulnerability impacts confidentiality, integrity, and availability, and changes the security scope. No affected versions or patch information are provided.

Creative Cloud Desktop has an Uncontrolled Search Path Element vulnerability that allows a low-privileged attacker to execute arbitrary code with the current user's privileges. Exploitation requires user interaction, specifically opening a malicious file. This vulnerability can lead to high impact on confidentiality, integrity, and availability.

Adobe Campaign Classic (ACC) suffers from a critical code injection vulnerability (CVE-2026-104351) that allows a low-privileged attacker to execute arbitrary code without user interaction. The vulnerability affects the current user context and changes the security scope. It has a very high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.

A Reflected Cross-site Scripting (XSS) vulnerability exists in the Autodesk Fusion desktop application due to a maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL. When a user invokes such a URL, the vulnerability can be triggered, potentially allowing an attacker to read local files or execute arbitrary code within the context of the current process.

A stored cross-site scripting (XSS) vulnerability exists in the Autodesk Fusion desktop application due to a maliciously crafted HTML payload embedded in a design name. When another user opens the manipulated design, the payload is executed, potentially allowing arbitrary code execution or local file reading within the context of the application process.

CVE-2026-93864 is a link following vulnerability in the WatchGuard Fireware OS firewall daemon. It allows a local attacker with low-privileged code execution to overwrite arbitrary files with root privileges and tamper with firewall IP set data by planting a crafted file system object and triggering a list update. This vulnerability can lead to privilege escalation and manipulation of firewall configurations.

A vulnerability in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allows a local authenticated attacker with low privileges to execute arbitrary code with SYSTEM privileges by supplying a signed executable through a forged IPC response that loads a malicious DLL from a user-writable temporary directory.

CVE-2026-93862 is an out-of-bounds read vulnerability in the FireCluster Sync processing component of a firewall cluster. An attacker with network access to the cluster interconnect, such as a compromised cluster peer or an on-path attacker, can exploit this flaw by sending specially crafted traffic. This causes repeated crashes of the cluster synchronization process, resulting in a sustained denial of service condition. The vulnerability has a high severity rating with a CVSS score of 7.2. No patch or remediation information is currently available.

An integer overflow vulnerability exists in the WebSocket connection handling of WatchGuard Fireware OS's Access Portal. This flaw allows a remote, unauthenticated attacker to perform a heap buffer overflow by sending a specially crafted request when the Access Portal feature is enabled. The vulnerability is rated critical with a CVSS score of 9.2. No affected versions or patch information are provided.

A stack-based buffer overflow vulnerability exists in the SIP proxy component of Fireware OS. This flaw allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy. The vulnerability is critical with a CVSS score of 9.2, indicating high impact and ease of exploitation. No affected versions or patch information is provided.

CVE-2025-64394 is a vulnerability in Veeam Backup for Microsoft 365 that allows a low-privileged local user to write arbitrary files with SYSTEM privileges during the software installation process. This flaw can enable privilege escalation or denial of service conditions. The vulnerability has a medium severity rating with a CVSS score of 4.3. No affected versions or patch information are provided, and there are no known exploits in the wild.

CVE-2026-93865 is a critical vulnerability in the Fireware OS FireCluster synchronization daemon. It allows a remote, unauthenticated attacker to perform privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when clustering is enabled. This flaw is due to missing authentication in the synchronization daemon.

An XPath injection vulnerability exists in WatchGuard Fireware OS's SSH authentication process. This flaw allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting specially crafted requests. The vulnerability has a high severity rating with a CVSS score of 8.7. No affected versions or patch information are provided in the available data.

An improper access control vulnerability exists in the IPC communication between TeamViewer Full Client or Host versions prior to 15.83 and the Remote Management Monitoring component prior to 26.10.1. This flaw allows a local authenticated attacker with low privileges to execute scripts with SYSTEM or root privileges.

A path traversal vulnerability exists in Dexmal Dexbotic up to version 0.2.0 in the load_pretrained_gr00t function of the gr00tsonic Checkpoint Loader component. This flaw allows remote attackers to manipulate the weight_map argument to perform path traversal. Exploit code has been published, but the vendor has not yet responded or issued a fix.