CVE-2024-52336

Tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root

A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with `script_pre` or `script_post` options that permit arbitrary scripts with their absolute paths to be passed. These user or attacker-controlled executable scripts or programs could then be executed by Tuned with root privileges that could allow attackers to local privilege escalation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2024-5154

Cri-o: malicious container can create symlink on host

A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.

CVSS 3.1 · 8.1 High EPSS 1.2% KEV · Not listed

Vendors

Kubernetes Redhat

Products

Cri-o Enterprise Linux Openshift and 1 more

CVE-2026-97701

Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, the authenticated POST /messages/render endpoint renders the content parameter without enforcing the normal message length limit used by message send and edit operations. An authenticated user can submit Markdown up to the server body-size limit, causing disproportionate backend CPU consumption, and repeated or concurrent requests can degrade Markdown rendering performance or backend availability for other users. This issue is fixed in version 12.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Zulip

Products

Zulip

CVE-2026-93900

Simple CAPTCHA with Cloudflare Turnstile <= 1.44.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the [gravity-simple-turnstile] shortcode in versions up to, and including, 1.44.3 This is due to insufficient input sanitization and output escaping on the shortcode attribute in the cfturnstile_gravity_shortcode() function: the value is filtered only by esc_html() and sanitize_text_field() (neither of which touches parentheses or dots) and then emitted via esc_js() in a raw JavaScript expression context outside any string literal (esc_js only escapes quotes, backslashes, and newlines). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-93866

Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write

An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted request while the Access Portal feature is enabled.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-93434

Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets

An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-92377

Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows

Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allows a local authenticated attacker with low privileges to supply a signed executable through a forged IPC response and cause it to load a malicious DLL from a user-writable temporary directory. Successful exploitation results in arbitrary code execution with NT AUTHORITY\SYSTEM privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Teamviewer

Products

Full Client Host

CVE-2026-92376

Local Privilege Escalation via IPC Broker Impersonation in TeamViewer Remote Management Monitoring for Windows

Improper authentication in the inter-process communication (IPC) mechanism of TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC broker and cause the Monitoring service to execute arbitrary code with NT AUTHORITY\SYSTEM privileges, resulting in local privilege escalation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Teamviewer

Products

Remote Management - Monitoring

CVE-2026-92375

Local privilege escalation via improper IPC access control in TeamViewer Remote Management Monitoring

An improper access control vulnerability in the IPC communication between TeamViewer Full Client or Host prior to version 15.83 and the Remote Management Monitoring component prior to version 26.10.1 allows a local authenticated attacker with low privileges to execute scripts as SYSTEM/root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Teamviewer

Products

Full Client Host Remote Management - Monitoring

CVE-2026-92374

Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS

A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Teamviewer

Products

Full Client Host

CVE-2026-92372

Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution

An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer Full Client for Linux and macOS prior to version 15.83 allows a remote attacker to execute arbitrary code by supplying crafted screen-image data during a remote-control session. The vulnerability can also be exploited by persuading a user to open a specially crafted TeamViewer session recording (.tvs). Missing destination bounds checking in the decoder allows crafted screen-image data to cause an out-of-bounds write to the image buffer. Exploitation requires user interaction.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Teamviewer

Products

Full Client

CVE-2026-90464

Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root

An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. Written content is limited to numeric values.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-90442

Fireware OS Authenticated Stack Buffer Overflow in certd Allows Denial of Service

A stack-based buffer overflow vulnerability in the Fireware OS certd process allows an authenticated attacker with access to the Firebox management interface to crash the certificate management service and potentially execute arbitrary code by sending a specially crafted request.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-88812

X.Org Server XKB SetGeometry TextDoodad Double Free

A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

X.org

Products

Xorg-server Xorg-x11-server Xwayland

CVE-2026-87085

Tanium addressed a SQL injection vulnerability in Provision.

Tanium addressed a SQL injection vulnerability in Provision.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Provision

CVE-2026-82984

Authenticated Non-Members Can Enumerate Team Resources via API in Nextcloud Server

When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers. This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.

CVSS 3.0 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Server

CVE-2026-82332

Fireware OS Improper Authentication in AuthPoint MFA Verification Allows Session Hijacking

An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local, unauthenticated attacker on the appliance to hijack another user's in-progress MFA session by supplying a specially crafted request and convincing the victim user to accept an MFA push notification.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-82033

DeepSeek Harness Unauthenticated RPC Command Execution

DeepSeek Harness prior to 0.1.2-alpha.2, and specifically commit 3e24087, contains a missing authentication vulnerability in its web profile HTTP and WebSocket RPC control plane, allowing any local process, including those running as a different OS user, to reach unauthenticated session methods such as session.create and session.prompt. Attackers can invoke session.prompt to trigger the agent's bash and filesystem tools, achieve arbitrary command execution as the victim user using their configured model credentials, intercept live session traffic and logs over the event mux stream, and bypass human tool-approval checks via POST /api/respond by matching only rpcId, approvalId, and sessionId values broadcast over the ungated stream.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Deepseek-ai

Products

Deepseek-harness

CVE-2026-77173

Files with # in name not flagged as confidential in Nextcloud

A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.

CVSS 3.0 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Files Confidential

CVE-2026-77171

Public Link Allows Unauthorized Page Creation in Nextcloud Collectives

A public shared collective always allowed recipients of the link to create pages.

CVSS 3.0 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Collectives