Threats affecting pkg:generic/hunspell

CVE-2026-93865 is a critical vulnerability in the Fireware OS FireCluster synchronization daemon. It allows a remote, unauthenticated attacker to perform privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when clustering is enabled. This flaw is due to missing authentication in the synchronization daemon.

An XPath injection vulnerability exists in WatchGuard Fireware OS's SSH authentication process. This flaw allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting specially crafted requests. The vulnerability has a high severity rating with a CVSS score of 8.7. No affected versions or patch information are provided in the available data.

An improper access control vulnerability exists in the IPC communication between TeamViewer Full Client or Host versions prior to 15.83 and the Remote Management Monitoring component prior to 26.10.1. This flaw allows a local authenticated attacker with low privileges to execute scripts with SYSTEM or root privileges.

A path traversal vulnerability exists in Dexmal Dexbotic up to version 0.2.0 in the load_pretrained_gr00t function of the gr00tsonic Checkpoint Loader component. This flaw allows remote attackers to manipulate the weight_map argument to perform path traversal. Exploit code has been published, but the vendor has not yet responded or issued a fix.

CVE-2026-90465 is a critical vulnerability in the FireCluster Sync processing component where missing authentication allows an attacker on the cluster interconnect to execute privileged firewall management actions as root. This can be exploited by a compromised cluster peer or an on-path network attacker sending specially crafted requests.

An improper authentication vulnerability exists in WatchGuard Fireware OS's AuthPoint multi-factor authentication process. This flaw allows a local, unauthenticated attacker on the appliance to hijack another user's in-progress MFA session by sending a specially crafted request and tricking the victim into accepting an MFA push notification. The vulnerability has a medium severity rating with a CVSS score of 5.7. No affected versions or patches are explicitly stated in the provided data.

CVE-2026-90442 is a stack-based buffer overflow vulnerability in the Fireware OS certd process. It allows an authenticated attacker with access to the Firebox management interface to crash the certificate management service and potentially execute arbitrary code by sending a specially crafted request. The vulnerability has a high severity score of 8.6. No patch or remediation information is currently provided.

A TOCTOU race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host for macOS prior to version 15.83 allows a local attacker with low privileges to bypass installer package verification and install a malicious package. This can lead to local privilege escalation to root.

A command injection vulnerability exists in the desmondmorris node-tesseract package up to version 0.2.7. The flaw is in the process function of lib/tesseract.js, specifically in the Command Builder component, where manipulation of the image argument can lead to OS command injection. This vulnerability can be exploited remotely. Public exploit code has been disclosed, but the project has not yet responded or issued a fix.

A vulnerability in TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC broker. This leads to the Monitoring service executing arbitrary code with SYSTEM privileges, resulting in local privilege escalation.

A vulnerability in WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with read-only Device Monitor privileges and management CLI access to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. The written content is limited to numeric values.

An out-of-bounds write vulnerability exists in the screen-image decoder of TeamViewer Full Client for Linux and macOS versions prior to 15.83. This flaw allows a remote attacker to execute arbitrary code by sending crafted screen-image data during a remote-control session or by tricking a user into opening a malicious TeamViewer session recording (.tvs) file. Exploitation requires user interaction. The vulnerability arises from missing destination bounds checking in the decoder, leading to an out-of-bounds write to the image buffer.

A critical Cross-Site Request Forgery (CSRF) vulnerability exists in Tribulant Software Newsletters newsletters-lite versions up to 4.18.2. This flaw allows an attacker to perform unauthorized actions on behalf of an authenticated user by exploiting the lack of proper request validation.

A path traversal vulnerability exists in the Persistor._decompress function of the Model Persistor component in crownpku Rasa_NLU_Chi up to version 0.12.2. This vulnerability allows remote attackers with low privileges to manipulate file paths, potentially leading to unauthorized access or modification of files. Public exploit code is available, but no official fix or patch has been released yet.

A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to cause denial of service and potentially execute arbitrary code by returning a specially crafted response.

A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service. An attacker who can control or intercept traffic to the configured Active Directory server may exploit this by sending a specially crafted response. This can lead to denial of service and potentially arbitrary code execution. The vulnerability is critical with a CVSS 4.0 score of 9.2. No affected versions or patch information are provided.

CVE-2026-113881 is a stack-based buffer overflow vulnerability in Fireware OS's VPN Network Access Enforcement process. It allows an authenticated mobile VPN user to cause a denial of service and potentially execute arbitrary code with unprivileged process rights by sending a specially crafted request. The vulnerability has a medium severity rating with a CVSS score of 6.1. No affected versions or patch information are provided.

A vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback network traffic to obtain the user's VPN username and password because sensitive information is transmitted in cleartext.

A vulnerability in Autodesk Fusion Post Processor Utility Extension allows a maliciously crafted .stack.json file to trigger a trusted Markdown injection. This can lead to arbitrary command execution in the context of the current user.

A vulnerability in Tidewave versions from 0.8.0 before 0.9.2 allows an attacker to read filesystem path names of the application via the /tidewave/connect endpoint or the rendered toolbar. This occurs because the responses do not validate the Host header, enabling a web page that rebinds its domain to the loopback address to perform same-origin requests and access sensitive path information. The disclosed paths can reveal local usernames and project layout details. The issue has a low severity rating with a CVSS score of 2.3.