CVE-2026-19042Command Injection in TeamViewer Desktop Client for Linux through Chat Link HandlingCVSS8.8High–Not in KEV1.8%EPSS1article
CVE-2026-92370Remote Session Access Control Bypass Leading to Remote Code ExecutionCVSS8.8High–Not in KEV0.4%EPSS2articles
CVE-2026-92368Heap-Based Buffer Overflow in TeamViewer Session Recording Playback Leads to Remote Code ExecutionCVSS7.8High–Not in KEV0.1%EPSS2articles
CVE-2026-19743Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop ClientsCVSS7.8High–Not in KEV0.1%EPSS2articles
CVE-2026-92371Local Privilege Escalation via Improper Link Resolution in Cloud Session RecordingCVSS7.0High–Not in KEV0.1%EPSS2articles
CVE-2026-92369Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege EscalationCVSS7.3High–Not in KEV0.1%EPSS2articles
How these numbers are made
CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.
CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.
Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.
Product names are grouped by normalised names, with version and edition tails removed.
Fix listed refers to an advisory. Unknown fix status is counted as not listed.