CVE-2026-93866

Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write

An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted request while the Access Portal feature is enabled.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-93434

Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets

An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-92377

Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows

Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allows a local authenticated attacker with low privileges to supply a signed executable through a forged IPC response and cause it to load a malicious DLL from a user-writable temporary directory. Successful exploitation results in arbitrary code execution with NT AUTHORITY\SYSTEM privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Teamviewer

Products

Full Client Host

CVE-2026-92376

Local Privilege Escalation via IPC Broker Impersonation in TeamViewer Remote Management Monitoring for Windows

Improper authentication in the inter-process communication (IPC) mechanism of TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC broker and cause the Monitoring service to execute arbitrary code with NT AUTHORITY\SYSTEM privileges, resulting in local privilege escalation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Teamviewer

Products

Remote Management - Monitoring

CVE-2026-92375

Local privilege escalation via improper IPC access control in TeamViewer Remote Management Monitoring

An improper access control vulnerability in the IPC communication between TeamViewer Full Client or Host prior to version 15.83 and the Remote Management Monitoring component prior to version 26.10.1 allows a local authenticated attacker with low privileges to execute scripts as SYSTEM/root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Teamviewer

Products

Full Client Host Remote Management - Monitoring

CVE-2026-92374

Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS

A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer package verification and install a malicious package. Successful exploitation can lead to local privilege escalation to root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Teamviewer

Products

Full Client Host

CVE-2026-92372

Out-of-bounds Write in TeamViewer Full Client for Linux and macOS Allows Remote Code Execution

An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer Full Client for Linux and macOS prior to version 15.83 allows a remote attacker to execute arbitrary code by supplying crafted screen-image data during a remote-control session. The vulnerability can also be exploited by persuading a user to open a specially crafted TeamViewer session recording (.tvs). Missing destination bounds checking in the decoder allows crafted screen-image data to cause an out-of-bounds write to the image buffer. Exploitation requires user interaction.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Teamviewer

Products

Full Client

CVE-2026-90464

Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root

An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. Written content is limited to numeric values.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-90442

Fireware OS Authenticated Stack Buffer Overflow in certd Allows Denial of Service

A stack-based buffer overflow vulnerability in the Fireware OS certd process allows an authenticated attacker with access to the Firebox management interface to crash the certificate management service and potentially execute arbitrary code by sending a specially crafted request.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-88812

X.Org Server XKB SetGeometry TextDoodad Double Free

A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a crash or potentially code in the x server context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

X.org

Products

Xorg-server Xorg-x11-server Xwayland

CVE-2026-87085

Tanium addressed a SQL injection vulnerability in Provision.

Tanium addressed a SQL injection vulnerability in Provision.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Provision

CVE-2026-82984

Authenticated Non-Members Can Enumerate Team Resources via API in Nextcloud Server

When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers. This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.

CVSS 3.0 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Server

CVE-2026-82332

Fireware OS Improper Authentication in AuthPoint MFA Verification Allows Session Hijacking

An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local, unauthenticated attacker on the appliance to hijack another user's in-progress MFA session by supplying a specially crafted request and convincing the victim user to accept an MFA push notification.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-82033

DeepSeek Harness Unauthenticated RPC Command Execution

DeepSeek Harness prior to 0.1.2-alpha.2, and specifically commit 3e24087, contains a missing authentication vulnerability in its web profile HTTP and WebSocket RPC control plane, allowing any local process, including those running as a different OS user, to reach unauthenticated session methods such as session.create and session.prompt. Attackers can invoke session.prompt to trigger the agent's bash and filesystem tools, achieve arbitrary command execution as the victim user using their configured model credentials, intercept live session traffic and logs over the event mux stream, and bypass human tool-approval checks via POST /api/respond by matching only rpcId, approvalId, and sessionId values broadcast over the ungated stream.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Deepseek-ai

Products

Deepseek-harness

CVE-2026-77173

Files with # in name not flagged as confidential in Nextcloud

A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.

CVSS 3.0 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Files Confidential

CVE-2026-77171

Public Link Allows Unauthorized Page Creation in Nextcloud Collectives

A public shared collective always allowed recipients of the link to create pages.

CVSS 3.0 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Collectives

CVE-2026-77167

nextcloud: Nextcloud: Denial of Service via federated share endpoint abuse

Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Server

CVE-2026-67400

Missing Token Type Check Exposes WOPI Configuration in Nextcloud Richdocuments

A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.

CVSS 3.0 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Richdocuments

CVE-2026-4337

Unrestricted Upload of File in PuMuKIT application

Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user to upload any type of file to the server, and to any path where the web server user has write permissions. This could also allow them to delete files.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Pumukit

Products

Pumukit

CVE-2026-41022

TLS Certificate Validation Failure in Eaton easySoft Allows Man-In-The-Middle Attacks

Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between easySoft and easyE4.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Eaton

Products

Easysoft