CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 27/10/2026 |
| CVE-2026-116863 | CRITICAL9.6 | Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2. | 27/10/2026 |
| CVE-2026-115495 | MEDIUM5.7 | Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback traffic to obtain the user’s VPN username and password. | 27/10/2026 |
| CVE-2026-113881 | MEDIUM6.1 | A stack-based buffer overflow vulnerability in Fireware OS's VPN Network Access Enforcement process allows an authenticated mobile VPN user to create a denial of service condition and potentially execute arbitrary code as an unprivileged process by sending a specially crafted request. | 27/10/2026 |
| CVE-2026-112710 | CRITICAL9.2 | A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response. | 27/10/2026 |
| CVE-2026-112709 | CRITICAL9.2 | A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service condition and potentially execute arbitrary code by returning a specially crafted response. | 27/10/2026 |
| CVE-2026-111585 | HIGH8.8 | An integer overflow in the remote-control
screen processing component of TeamViewer clients (Full Client, Portable and Remote
Control App) prior to version 15.83 may allow a malicious remote host to cause
a denial of service or, depending on the platform, potentially execute
arbitrary code with the privileges of the vi | 27/10/2026 |
| CVE-2026-111584 | HIGH7.3 | A race condition in the installation
process of TeamViewer Remote Management - Patch Management for Windows prior to
version 26.9.1 allows a local authenticated attacker with low privileges to
execute arbitrary code with elevated privileges by replacing the service
executable in an insufficiently protected temporary di | 27/10/2026 |
| CVE-2026-111583 | HIGH7.3 | Improper access control in the installer
staging directory used by TeamViewer Full Client and Host prior to version
15.82 for Windows during installation of Advanced Asset Management allows a
local authenticated user with low privileges to execute arbitrary commands as
SYSTEM. An attacker can place a crafted installer | 27/10/2026 |
| CVE-2026-111582 | HIGH7.3 | A DLL loading vulnerability in the
TeamViewer Remote Management Monitoring installer for Windows prior to version 26.10.1
allows a local authenticated attacker with low privileges to execute arbitrary
code with elevated privileges. Exploitation requires user interaction. | 27/10/2026 |
| CVE-2026-111107 | HIGH8.7 | A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface allows a remote, unauthenticated attacker with network access to the management interface to crash the management service by sending a specially crafted login request. Repeated exploitation terminates all active administrator sess | 27/10/2026 |
| CVE-2026-109823 | LOW2.3 | An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar.
Neither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag with a same-origin request, whic | 27/10/2026 |
| CVE-2026-107672 | HIGH8.8 | A maliciously crafted .stack.json file can trigger a trusted Markdown injection vulnerability in Autodesk Fusion Post Processor Utility Extension. A malicious actor may exploit this vulnerability to execute arbitrary commands in the context of the current user. | 27/10/2026 |
| CVE-2026-104381 | MEDIUM6.0 | A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positioned on the cluster synchronization network segment to force premature VPN tunnel termination by sending crafted cluster synchronization traffic. | 27/10/2026 |
| CVE-2026-104189 | HIGH7.5 | The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who knows a share token could read the shared file's contents even when the link share | 27/10/2026 |
| CVE-2026-103594 | CRITICAL9.5 | A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud to create a Denial of Service condition and potentially execute arbitrary code by tampering with a FireCloud G | 27/10/2026 |
| CVE-2026-103593 | HIGH7.1 | A stack-based buffer overflow vulnerability in the Fireware OS logging service allows a network-adjacent attacker who can impersonate or intercept traffic to the configured log server to execute arbitrary code with root privileges by presenting a specially crafted certificate. | 27/10/2026 |
| GHSA-3w55-933p-8pv5 | HIGH7.1 | Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage | 27/10/2026 |