Security Bulletin: NVIDIA Isaac Launchable - May 2026

NVIDIA has released a software update for NVIDIA® Isaac Launchable. To protect your system, download and install the latest version of Isaac Launchable. Go to NVIDIA Product Security. Details The following table summarizes the potential vulnerabilities that this security update addresses and thei...

PT-2026-43341

NVIDIA GPU Display Driver for Linux contains a vulnerability where an advanced attacker could use a race condition to leak sensitive memory, which might cause limited exposure of sensitive information to an unauthorized actor. A successful exploit of this vulnerability might lead to denial of...

PT-2026-43336

Name of the Vulnerable Software and Affected Versions NVIDIA Display Driver for Windows and Linux affected versions not specified Description An out-of-bounds write issue exists, which occurs when a program writes data past the end of the intended buffer. A successful exploit could result in deni...

PT-2026-43337

Name of the Vulnerable Software and Affected Versions NVIDIA Display Driver for Linux affected versions not specified Description A flaw exists in a kernel mode layer handler that allows a user to cause improper permission handling. This issue could lead to denial of service, escalation of...

PT-2026-43335

Name of the Vulnerable Software and Affected Versions NVIDIA Display Driver for Linux affected versions not specified Description An issue exists where an attacker could cause an incorrect conversion between numeric types, resulting in a heap buffer overflow. A heap buffer overflow occurs when a...

PT-2026-43334

Name of the Vulnerable Software and Affected Versions NVIDIA Display Driver for Windows affected versions not specified Description An issue exists where an attacker could cause a time-of-check time-of-use TOCTOU condition. TOCTOU is a race condition where a system checks a condition such as a...

PT-2026-43344

NVIDIA vGPU software contains a vulnerability in the virtual GPU manager, where an attacker could cause an out-of-bound access. A successful exploit of this vulnerability might lead to data tampering, denial of service, or information disclosure...

Malicious code in @zizie071/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e6d5096096e7e958916c5449a7480949135e6af5cd9acd4e1b1edab8c331163 On require, index.js schedules install.js which locates the installer's @whiskeysockets/baileys package on disk and overwrites lib/Socket/newsletter....

MAL-2026-4473 Malicious code in @zizie071/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e6d5096096e7e958916c5449a7480949135e6af5cd9acd4e1b1edab8c331163 On require, index.js schedules install.js which locates the installer's @whiskeysockets/baileys package on disk and overwrites lib/Socket/newsletter....

Linux Distros Unpatched Vulnerability : CVE-2026-32175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could writ...

PT-2026-43117

A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handler. Such manipulation of the argument DefMsgTemplate.content leads to improper neutralization of special elements used in a template engin...

CVE-2026-32175

A flaw was found in dotnet. Improper handling of specially crafted files can cause a path traversal vulnerability in .NET Core, allowing an attacker who can send a malicious file to a vulnerable system to write to arbitrary files and directories in certain locations. Mitigation Mitigation for thi...

CVE-2026-41090

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network...

EUVD-2026-31512

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network...

CVE-2026-41090 Microsoft Copilot Tampering Vulnerability

...

CVE-2026-41090 Microsoft Copilot Tampering Vulnerability

...

CVE-2026-41090

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network...

CVE-2026-41090

CVE-2026-41090 affects Microsoft Copilot. The vulnerability arises from improper neutralization of elements used in a command (command injection) that enables tampering over a network. The CVSS‑3.1 vector indicates network attack, high confidentiality and integrity impact, no availability impact,...

jwt-pwn

jwt-pwn A zero-dependency Python 3 toolkit for discovering an...

CVE-2026-8347

Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog. This can cause Cross-entity state tampering with view-only permission on one entry. To be affected, a website has to be using express and relying on express entity...