CVE-2026-0515 Insufficient parameter validation in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety

Insufficient Parameter Validation in the SchedGet system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel...

CVE-2026-56156 Microsoft Excel Remote Code Execution Vulnerability

...

CVE-2026-55138 Microsoft Excel Information Disclosure Vulnerability

...

CVE-2026-55045

CVE-2026-55045 is an Office remote code execution vulnerability described as an out-of-bounds read in Microsoft Office that could enable a local attacker to execute code. Connected sources tie this CVE to Microsoft Office components (Word/PowerPoint/SharePoint) with local-exploit prerequisites an...

CVE-2026-55027 Microsoft Office Information Disclosure Vulnerability

...

CVE-2026-50348 Windows Runtime Elevation of Privilege Vulnerability

...

LabubaRAT Masquerades as NVIDIA Software to Control Windows Hosts

Cybersecurity researchers have flagged a previously undocumented Rust-based remote access trojan RAT codenamed LabubaRAT that masquerades as NVIDIA software to blend into target environments. "LabubaRAT creates a reusable foothold for hands-on activity," Blackpoint Cyber researchers Sam Decker an...

CVE-2026-60081

DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column of profile dump files is used to allocate an array of data for the parser. An unbounded value allows an attacker to specify a large index and consume available memory...

CVE-2026-11917 ThinManager® - Path Traversal via API

A path traversal security issue exists within Rockwell Automation ThinManager® software due to improper limitation of file save operations within the API. An authenticated attacker could exploit this vulnerability to write arbitrary files to restricted system directories outside of the...

GHSA-3CFQ-4XX4-RMPG vulnerabilities

Vulnerabilities for packages: libssh2...

ROOT-APP-NPM-CVE-2025-56200 CVE-2025-56200 in @rootio/validator - Patched by Root

Root has patched CVE-2025-56200 in the @rootio/validator package for Root:npm. Multiple fixed versions available...

CVE-2026-62393

Apache Kylin CVE-2026-62393 involves improper authorization in job information retrieval, enabling access to unauthorized jobs across projects for versions 4–5.0.3. Root cause: insufficient permission checks during job info requests. Impact: potential exposure of job data across projects; CVSSv3....

XenServer Security Update for CVE-2026-42491

Severity: Medium Description of Problem An issue has been identified in the XenServer management API SDK that may allow an attacker on the management network who is able to intercept specific HTTPS requests within a higher-level operation to be able to act with the privileges of the intercepted...

CVE-2025-40945

A vulnerability has been identified in COMOS V10.4.5 All versions V10.4.5.0.2, COMOS V10.6 All versions V10.6.1, Designcenter NX All versions V2512.7000, Simcenter 3D All versions V2512.7000, Simcenter Femap V2506 All versions V2506.0003, Simcenter Femap V2512 All versions V2512.0002, Simcenter...

EUVD-2025-210460

A vulnerability has been identified in COMOS V10.4.5 All versions V10.4.5.0.2, COMOS V10.6 All versions V10.6.1, Designcenter NX All versions V2512.7000, Simcenter 3D All versions V2512.7000, Simcenter Femap V2506 All versions V2506.0003, Simcenter Femap V2512 All versions V2512.0002, Simcenter...

MAL-2026-10560 Malicious code in clipboard-drop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea807812d5f872524eab6c57931788239310050ffb4c477643977def9dac8fb9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Incorrect Permission Assignment for Critical Resource

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the MCP loopback process. An attacker can gain unauthorized access to owner-level tools by exploiting configured input paths to...

PT-2026-58443

Name of the Vulnerable Software and Affected Versions Microsoft Office affected versions not specified Description A use after free issue exists in Microsoft Office, which could allow an unauthorized attacker to execute code locally. This occurs when a user opens a specially crafted file locally ...

PT-2026-60395

Name of the Vulnerable Software and Affected Versions Zoom Clients for Windows affected versions not specified Description A time-of-check to time-of-use TOCTOU race condition occurs during the installation and uninstallation process. This flaw allows an authenticated local user to escalate...

CVE-2025-56362

The Matter SDK (connectedhomeip) versions prior to 1.4.2 (including versions 1.3 and 1.4, commit ab3d5ae ) are vulnerable to a reachable assertion vulnerability. The issue resides in the Level Control cluster's periodic server tick logic. An unauthenticated remote attacker can trigger a crash by ...