CVE-2026-16444 (TV-2026-1008, CVSS 7.5) was invisible on every TeamViewer
install. NVD carries no configuration for it — the record sits at "Received"
with zero cpeMatch entries — so the CPE path was blind by construction, and
cvelistV5 was the only structured source left. There the record is filed under
ONE compound product string:
vendor "TeamViewer" product "Full Client, Host, QuickSupport & Portable"
versions 15.0 lessThan 15.81.5
The curated pair list held ("teamviewer", "full client") and four siblings,
none of which equals that string, so the record never entered the index and
15.80.6.0 was never compared against 15.81.5. Across the 54 TeamViewer records
the same client appears under 25 spellings; the compound form is the one the
vendor has used since 2026, which is why coverage looked fine until now.
Replaced by a _PRODUCT_PATTERNS entry, the same mechanism Windows and Apple
releases use. The regex is anchored, enumerates the client component words and
excludes the mobile apps by name: DEX (32 records, versioned 9.x/24.x/25.x),
ONE, Frontline, IoT, Engage, Meeting and Patch & Asset Management all ship
their own version lines and must never be compared against a 15.x client.
CVE-2026-19042 is the control and is deliberately NOT a finding on Windows:
the record and the bulletin both scope it to Linux.
Also here, from the same audit:
- NVD files the client under a SECOND CPE name since the 2023 rename —
28 records say teamviewer:teamviewer, 2 say teamviewer:remote. The registry
queried one, so it lost the other's; added via `also`, the way Adobe's two
Reader names already are.
- New source teamviewer_bulletin_service: the vendor's own security bulletins,
for the same reason Firefox has MFSA and Notepad++ has repo advisories.
5 of the 30 published bulletins carry NO CVE id at all — TV-2026-1006 is a
real Full Client flaw (15.78–15.79.3) that no CVE-keyed source can see. The
bulletin id stands in as the identifier, as GHSA- and NESSUS-PLUGIN- do.
Rows are scoped per platform and per release line; bulletins that state no
version ("All", "Server-side hot fix") are skipped rather than guessed at.
- _upsert learns `refs`, so a finding whose id has no public catalogue page
carries the advisory URL as its only reference.
- An index that parses to empty is never stored: it would be stamped fresh for
24h, leave every TeamViewer finding untouched, and the app-scan reconcile
reads untouched as "no longer detected" → patched.
Verified against the live feeds: 30 bulletins, 17 with client version tables,
and on a Windows host at 15.80.6.0 exactly one finding — CVE-2026-16444,
fix 15.81.5.
vulncheck
7707a05bac