Monthly
Integrity tampering in Thermo Fisher Applied Biosystems Genetic Analyzers allows any user with local file system access to silently modify .fsa and .hid output files - the raw DNA sequence and fragment analysis data produced by these instruments - because no cryptographic integrity check (CWE-353) is applied to these files. Affected products span eight distinct data collection and analysis software lines, including the forensic-grade GeneMapper ID-X platform, meaning tampered files could propagate falsified DNA profiles into criminal proceedings or clinical diagnostics without detection. No public exploit code has been identified at time of analysis, and exploitation is covered by CISA ICS Medical Advisory ICSMA-26-216-01.
Persistent local code execution affects Anthropic Claude Desktop Cowork on macOS (v1.1348.0 through v1.2278.0) because the Cowork VM bootstrap validates only the presence of rootfs.img and a version marker string without verifying image content integrity at time-of-use. A local attacker with unprivileged code execution as the victim user can swap or modify the root filesystem image so subsequent Cowork VM boots trust the tampered image, yielding persistent arbitrary code execution inside the VM and access to host-mounted directories. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Missing integrity verification in OpenClaw before 2026.4.8 (npm package 'openclaw', tracked by the vendor as B-M3) lets attackers deliver tampered or malicious ClawHub plugin archives that install without any archive- or per-file integrity check, compromising the local assistant environment. The flaw was reported by VulnCheck and Tencent Zhuque Lab and is fixed in 2026.4.8; there is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 4th percentile). Because OpenClaw is a user-controlled local assistant, exploitation requires the victim to install a plugin whose download an attacker can substitute or tamper with.
Replay attack vulnerability in WeenyGenius, a computer lab management system by Howyar Technologies, allows unauthenticated adjacent-network attackers to forge student attendance status. By intercepting a legitimate student connection packet and replaying it, an attacker can make the management system believe the student remains connected after they have disconnected. No public exploit has been identified at time of analysis, and EPSS data is not available for this entry.
Arbitrary code execution in Dell ThinOS 10 (all builds prior to 2605_10.2616) is enabled by a missing integrity check (CWE-353) that allows a local high-privileged attacker to substitute unverified code or data in a load path the OS processes without cryptographic validation. Dell advisory DSA-2026-389 confirms both the vulnerability and a corrective update. No public exploit code or CISA KEV listing exists at time of analysis, limiting real-world risk to targeted insider-threat or physical-access scenarios.
Missing firmware integrity verification in ABB KNX Update Tool versions through 2.0.175 allows an adjacent network attacker with low-privilege access to inject tampered updates onto KNX building automation devices, leading to high integrity and availability impact. The vulnerability (CWE-353) means the tool accepts update packages without cryptographic validation, enabling a man-in-the-middle or rogue-update attack on the KNX bus segment. No public exploit code or CISA KEV listing has been identified at time of analysis, and active exploitation has not been confirmed.
Missing integrity verification in pnpm's GitHub codeload dependency resolution (versions prior to 10.33.4 and 11.0.7) enables a compromised or man-in-the-middle `codeload.github.com` server to deliver arbitrary malicious tarballs that pnpm installs without hash validation. Any developer project that sources dependencies from GitHub via pnpm is exposed when running `pnpm install` on affected versions, with potential for arbitrary code execution during the install lifecycle. No public exploit code exists and there is no CISA KEV listing, but the theoretical impact includes full developer workstation compromise and downstream supply chain contamination.
PowerDNS Recursor versions 5.2.x, 5.3.x, and 5.4.0 are vulnerable to denial of service when processing a zone transition from NSEC to NSEC3 DNSSEC record types, causing internal inconsistency and resolver unavailability. The vulnerability requires network access but elevated attack complexity, affecting recursive DNS resolvers in production environments. Vendor patches are available for all affected branches.
CVE-2026-3856 is a security vulnerability (CVSS 5.3) that allows an attacker. Remediation should follow standard vulnerability management procedures. Vendor patch is available.
Cryptopro Secure Disk contains a vulnerability that allows attackers to execute arbitrary code in the context of the root user and enables an attacker t (CVSS 6.8).
Integrity tampering in Thermo Fisher Applied Biosystems Genetic Analyzers allows any user with local file system access to silently modify .fsa and .hid output files - the raw DNA sequence and fragment analysis data produced by these instruments - because no cryptographic integrity check (CWE-353) is applied to these files. Affected products span eight distinct data collection and analysis software lines, including the forensic-grade GeneMapper ID-X platform, meaning tampered files could propagate falsified DNA profiles into criminal proceedings or clinical diagnostics without detection. No public exploit code has been identified at time of analysis, and exploitation is covered by CISA ICS Medical Advisory ICSMA-26-216-01.
Persistent local code execution affects Anthropic Claude Desktop Cowork on macOS (v1.1348.0 through v1.2278.0) because the Cowork VM bootstrap validates only the presence of rootfs.img and a version marker string without verifying image content integrity at time-of-use. A local attacker with unprivileged code execution as the victim user can swap or modify the root filesystem image so subsequent Cowork VM boots trust the tampered image, yielding persistent arbitrary code execution inside the VM and access to host-mounted directories. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Missing integrity verification in OpenClaw before 2026.4.8 (npm package 'openclaw', tracked by the vendor as B-M3) lets attackers deliver tampered or malicious ClawHub plugin archives that install without any archive- or per-file integrity check, compromising the local assistant environment. The flaw was reported by VulnCheck and Tencent Zhuque Lab and is fixed in 2026.4.8; there is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 4th percentile). Because OpenClaw is a user-controlled local assistant, exploitation requires the victim to install a plugin whose download an attacker can substitute or tamper with.
Replay attack vulnerability in WeenyGenius, a computer lab management system by Howyar Technologies, allows unauthenticated adjacent-network attackers to forge student attendance status. By intercepting a legitimate student connection packet and replaying it, an attacker can make the management system believe the student remains connected after they have disconnected. No public exploit has been identified at time of analysis, and EPSS data is not available for this entry.
Arbitrary code execution in Dell ThinOS 10 (all builds prior to 2605_10.2616) is enabled by a missing integrity check (CWE-353) that allows a local high-privileged attacker to substitute unverified code or data in a load path the OS processes without cryptographic validation. Dell advisory DSA-2026-389 confirms both the vulnerability and a corrective update. No public exploit code or CISA KEV listing exists at time of analysis, limiting real-world risk to targeted insider-threat or physical-access scenarios.
Missing firmware integrity verification in ABB KNX Update Tool versions through 2.0.175 allows an adjacent network attacker with low-privilege access to inject tampered updates onto KNX building automation devices, leading to high integrity and availability impact. The vulnerability (CWE-353) means the tool accepts update packages without cryptographic validation, enabling a man-in-the-middle or rogue-update attack on the KNX bus segment. No public exploit code or CISA KEV listing has been identified at time of analysis, and active exploitation has not been confirmed.
Missing integrity verification in pnpm's GitHub codeload dependency resolution (versions prior to 10.33.4 and 11.0.7) enables a compromised or man-in-the-middle `codeload.github.com` server to deliver arbitrary malicious tarballs that pnpm installs without hash validation. Any developer project that sources dependencies from GitHub via pnpm is exposed when running `pnpm install` on affected versions, with potential for arbitrary code execution during the install lifecycle. No public exploit code exists and there is no CISA KEV listing, but the theoretical impact includes full developer workstation compromise and downstream supply chain contamination.
PowerDNS Recursor versions 5.2.x, 5.3.x, and 5.4.0 are vulnerable to denial of service when processing a zone transition from NSEC to NSEC3 DNSSEC record types, causing internal inconsistency and resolver unavailability. The vulnerability requires network access but elevated attack complexity, affecting recursive DNS resolvers in production environments. Vendor patches are available for all affected branches.
CVE-2026-3856 is a security vulnerability (CVSS 5.3) that allows an attacker. Remediation should follow standard vulnerability management procedures. Vendor patch is available.
Cryptopro Secure Disk contains a vulnerability that allows attackers to execute arbitrary code in the context of the root user and enables an attacker t (CVSS 6.8).