Threats affecting pkg:generic/libraw

A vulnerability in TeamViewer Full Client and Host prior to version 15.82 for Windows allows a local authenticated user with low privileges to execute arbitrary commands as SYSTEM. This occurs due to improper access control in the installer staging directory during the installation of Advanced Asset Management. An attacker can exploit this by placing a crafted installer options file that the installer processes during service activation.

A race condition vulnerability exists in the installation process of TeamViewer Remote Management - Patch Management for Windows versions prior to 26.9.1. This flaw allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges by replacing the service executable in a temporary directory that is insufficiently protected during Patch Management activation.

A stack-based buffer overflow vulnerability exists in Fireware OS's WireGuard configuration processing. This flaw allows a remote attacker with man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud to cause a Denial of Service or potentially execute arbitrary code by tampering with a FireCloud Gateway configuration payload. The vulnerability is critical with a CVSS score of 9.5.

CVE-2026-103593 is a stack-based buffer overflow vulnerability in the Fireware OS logging service. It allows a network-adjacent attacker who can impersonate or intercept traffic to the configured log server to execute arbitrary code with root privileges by presenting a specially crafted certificate. The vulnerability has a high severity score of 7.1. No affected versions or patch information are provided.

A vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker on the cluster synchronization network segment to prematurely terminate VPN tunnels by sending crafted synchronization traffic.

A NULL pointer dereference vulnerability exists in the management interface of WatchGuard Fireware OS. This flaw allows a remote, unauthenticated attacker with network access to the management interface to crash the management service by sending a specially crafted login request. Exploiting this vulnerability repeatedly can terminate all active administrator sessions and ongoing management operations, potentially preventing management of the device. Importantly, traffic processing by the device is not affected.

CVE-2024-36315 is a medium severity vulnerability involving improper enforcement of the LFENCE serialization property. This flaw may allow attackers to bypass speculation barriers, potentially leading to unauthorized disclosure of sensitive information and loss of confidentiality.

The CTFer.io Terraform Provider for CTFd versions from 0.1.5 up to but not including 2.8.2 stores the ctfd_team.password value in Terraform state as a non-sensitive value. This means that anyone with access to the Terraform state file can read team passwords without needing additional decryption. The vulnerability is fixed in version 2.8.2.

When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed, or an attacker able to modify a feed delivered over HTTP, to make Thunderbird read local files and, on Windows, connect to an attacker-controlled network share, which could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are affected by the local file read only. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could make Thunderbird subscribe to such a location. On Windows this could leak the user's NTLM credentials to an attacker-controlled host on every calendar refresh, and changes to the calendar could be written to the attacker's share or overwrite a local file. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

MISP Guard, a proxy enforcing security policies on MISP feed data, had an incomplete input validation flaw in its handling of required taxonomy tags. The guard verified only that at least one tag from a required taxonomy was allowed but failed to ensure all tags from that taxonomy were permitted. This allowed events or attributes to carry both allowed and non-allowed tags simultaneously, bypassing data classification restrictions and potentially exposing sensitive data to unauthorized feed consumers. The vulnerability affected event-level and attribute-level validations, including nested and shadow attributes. It was fixed in version 1.4.

CVE-2026-115413 is a vulnerability in AWS aws-api-mcp-server versions 1.3.0 up to but not including 1.6.0. It involves missing token audience validation in the OAuth authentication mode, which could allow local users to perform AWS operations using the server's configured AWS credentials with an access token issued to another application by the same identity provider. The issue is fixed in version 1.6.0 by adding proper token audience or client ID validation.

CVE-2026-118171 is a missing authorization vulnerability in the strapi/content-manager package of Strapi Open Source and Enterprise Headless CMS version 5.51.0. It allows low-privileged administrators to generate preview URLs without possessing the necessary document identifiers or read permissions.

Strapi Open Source and Enterprise Headless CMS version 5.51.0 is vulnerable to a semi-blind Server-Side Request Forgery (SSRF) via webhook follow-redirect behavior. The webhook dispatcher follows HTTP redirects automatically without resolving the IP address after the redirect or checking if the redirected address is within private or link-local network ranges. This can lead to non-2xx HTTP responses from target endpoints being captured and reflected back to the caller.