MSC-2026-6313

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

EUVD-2025-210460

A vulnerability has been identified in COMOS V10.4.5 All versions V10.4.5.0.2, COMOS V10.6 All versions V10.6.1, Designcenter NX All versions V2512.7000, Simcenter 3D All versions V2512.7000, Simcenter Femap V2506 All versions V2506.0003, Simcenter Femap V2512 All versions V2512.0002, Simcenter...

CVE-2025-40945

A vulnerability has been identified in COMOS V10.4.5 All versions V10.4.5.0.2, COMOS V10.6 All versions V10.6.1, Designcenter NX All versions V2512.7000, Simcenter 3D All versions V2512.7000, Simcenter Femap V2506 All versions V2506.0003, Simcenter Femap V2512 All versions V2512.0002, Simcenter...

CVE-2024-7708

For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak...

MSC-2026-6300

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MSC-2026-6299

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-6298

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MAL-2026-10560 Malicious code in clipboard-drop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea807812d5f872524eab6c57931788239310050ffb4c477643977def9dac8fb9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Incorrect Permission Assignment for Critical Resource

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the MCP loopback process. An attacker can gain unauthorized access to owner-level tools by exploiting configured input paths to...

Security Bulletin: NVIDIA TensorRT - July 2026

NVIDIA has released a software update for NVIDIA® TensorRT. To protect your system, clone or update this software to TensorRT v11.0.0 and Polygraphy 0.50.0 from the NVIDIA/TensorRT GitHub repo, TensorRT product page, the network repository, or Python package index TensorRT, Polygraphy. Go to NVID...

PT-2026-58855

Name of the Vulnerable Software and Affected Versions Citrix XenServer SDK versions prior to 26.15.0 XenCenter versions prior to 2026.4.0 Description Some SDKs lack proper TLS verification during network communication with a host running XAPI. This flaw allows an attacker to perform a...

CVE-2025-56361

A reachable assertion vulnerability exists in the Matter SDK connectedhomeip 1.3 thru 1.4, specifically within the Level Control cluster's server tick logic emberAfLevelControlClusterServerTickCallback. When a MoveToLevel command is executed and followed by a conflicting write to the OperationMod...

PT-2026-58789

Name of the Vulnerable Software and Affected Versions Adobe Bridge affected versions not specified Description An out-of-bounds write flaw exists that could allow arbitrary code execution in the context of the current user. This occurs when a victim opens a malicious file, meaning user interactio...

PT-2026-58443

Name of the Vulnerable Software and Affected Versions Microsoft Office affected versions not specified Description A use after free issue exists in Microsoft Office, which could allow an unauthorized attacker to execute code locally. This occurs when a user opens a specially crafted file locally ...

CVE-2025-56363

A null pointer dereference vulnerability exists in the Matter SDK connectedhomeip before 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters Channel, Account Login, TargetNavigator, etc.. The function lacks proper validation of the delegate pointer before dereferencing. ...

PT-2026-60395

Name of the Vulnerable Software and Affected Versions Zoom Clients for Windows affected versions not specified Description A time-of-check to time-of-use TOCTOU race condition occurs during the installation and uninstallation process. This flaw allows an authenticated local user to escalate...

Why Not Fix It Once and for All? an Empirical Study of Multiple Patches for Vulnerability Fixes in Open-Source Software

Security patches for open-source software constitute a foundational resource for vulnerability remediation research and practice. However, analyzing and applying multiple patches remains challenging, especially when trying to determine at what point in a patch sequence a vulnerability is fully...

CVE-2025-56362

The Matter SDK (connectedhomeip) versions prior to 1.4.2 (including versions 1.3 and 1.4, commit ab3d5ae ) are vulnerable to a reachable assertion vulnerability. The issue resides in the Level Control cluster's periodic server tick logic. An unauthenticated remote attacker can trigger a crash by ...

Veeam Software Appliance/Veeam Infrastructure Appliance — Updater Component Vulnerability

Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program VDP for all Veeam products and perform extensive internal code audits. When a vulnerability is...

PT-2026-58864

In Ciena's Navigator Network Control Suite NCS and Manage Control Plan MCP, there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker...