Windows Media Photo Codec Information Disclosure Vulnerability

Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized attacker to disclose information locally...

CVE-2025-40945

A vulnerability has been identified in COMOS V10.4.5 All versions V10.4.5.0.2, COMOS V10.6 All versions V10.6.1, Designcenter NX All versions V2512.7000, Simcenter 3D All versions V2512.7000, Simcenter Femap V2506 All versions V2506.0003, Simcenter Femap V2512 All versions V2512.0002, Simcenter...

CVE-2025-40945

A vulnerability has been identified in COMOS V10.4.5 All versions V10.4.5.0.2, COMOS V10.6 All versions V10.6.1, Designcenter NX All versions V2512.7000, Simcenter 3D All versions V2512.7000, Simcenter Femap V2506 All versions V2506.0003, Simcenter Femap V2512 All versions V2512.0002, Simcenter...

CVE-2025-40945

CVE-2025-40945 affects multiple Siemens/Siemens Digital Industries software (e.g., COMOS, Designcenter NX, Simcenter suite, Solid Edge, Teamcenter Visualization, Tecnomatix, etc.) across numerous versions. The vulnerability is described as an untrusted search path in the IAM Client SDK that may a...

PT-2026-58168

Name of the Vulnerable Software and Affected Versions Windows GDI+ affected versions not specified Description A heap-based buffer overflow exists in Windows GDI+, which allows an unauthorized attacker to execute code locally. This issue can lead to remote code execution RCE on PCs and servers wh...

PT-2026-58334

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description Improper authorization in the RPC Runtime allows an authorized attacker to elevate privileges locally. This issue specifically involves the Netlogon RPC, which can be leveraged to escalate a...

PT-2026-58177

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally, potentially granting full control of the system. Recommendations Apply the July 2026...

PT-2026-58233

Name of the Vulnerable Software and Affected Versions Windows Overlay Filter affected versions not specified Description A heap-based buffer overflow occurs in the Windows Overlay Filter. This issue allows an authorized attacker to elevate privileges locally on the system. A heap-based buffer...

PT-2026-58610

Name of the Vulnerable Software and Affected Versions Microsoft Office affected versions not specified Description An out-of-bounds read allows an unauthorized attacker to locally disclose sensitive information, which can affect the system. Recommendations At the moment, there is no information...

PT-2026-58378

Name of the Vulnerable Software and Affected Versions Windows Kernel affected versions not specified Description An out-of-bounds read in the Windows Kernel allows an authorized attacker to elevate privileges locally. An out-of-bounds read occurs when the software reads data past the end of the...

PT-2026-58153

Name of the Vulnerable Software and Affected Versions Universal Plug and Play upnp.dll affected versions not specified Description Improper link resolution before file access, also known as link following, occurs in the upnp.dll component. This allows an authorized attacker to disclose informatio...

PT-2026-58185

Name of the Vulnerable Software and Affected Versions Windows Win32K affected versions not specified Description Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally. Recommendations At the moment, there is no information about a newer version that...

PT-2026-58349

Name of the Vulnerable Software and Affected Versions Windows Sensor Data Service affected versions not specified Description An incorrect access of an indexable resource, known as a range error, occurs within the Windows Sensor Data Service. This flaw allows an authorized attacker to elevate the...

PT-2026-58259

Name of the Vulnerable Software and Affected Versions Microsoft Active Directory Federation Services affected versions not specified Description An access control weakness exists in the service and admin surfaces of Microsoft Active Directory Federation Services AD FS due to insufficient...

PYSEC-2026-2511 Hermes Agent creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644)

Hermes Agent before 0.16.0 creates responsestore.db and webhooksubscriptions.json with world-readable permissions mode 0o644, exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can read these files directly to obtain sensitive data including...

PYSEC-2026-2512 hermes-agent has an Incorrect Comparison

A security flaw has been discovered in NousResearch hermes-agent 2026.4.23. Affected is the function discoverdashboardplugins of the file hermescli/webserver.py of the component CLI web-dashboard Interface. Performing a manipulation of the argument HERMESENABLEPROJECTPLUGINS results in incorrect...

PYSEC-2026-2987 Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

A security flaw has been discovered in pygments before 2.20.0. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been release...

PYSEC-2026-3385 Authenticated Local Privilege Escalation vulnerability in Intel Optimization for Tensorflow

Improper buffer restrictions in the IntelR Optimization for Tensorflow software before version 2.12 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2026-15524

A security vulnerability has been detected in alioshr memory-bank-mcp up to 0.2.1/3.1. This affects an unknown part of the file list-project-files-validation-factory.ts. Such manipulation of the argument projectName leads to path traversal. Local access is required to approach this attack. The...

CVE-2026-15520

A vulnerability was determined in GNU LibreDWG 0.13.4-154-g0b573035. This impacts the function decompressR2004section of the file src/decode.c of the component R2004 Section Decompression. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The explo...