Monthly
Missing integrity verification in the HPE Networking ClearPass Policy Manager client agent allows remote unauthenticated attackers to introduce untrusted code that the agent then executes on the enrolled client system, giving full code execution on that endpoint. Only systems running the vulnerable client agent (for example OnGuard deployments) are exposed; the ClearPass server itself is not the target of this flaw, and organizations that do not deploy the agent are unaffected. The input CVSS of 9.8 reflects the worst case, but the authoritative independent assessment scores it AV:N/AC:H, because the attacker must first be able to supply or substitute the code the agent consumes - typically a man-in-the-middle position on the agent's communication or update channel, or control of a source the agent implicitly trusts. There is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so the practical risk is conditional on the attacker obtaining that network positioning or trusted-source access.
Missing integrity verification in the HPE ClearPass Policy Manager OnGuard agent allows an unauthenticated, remote attacker to execute arbitrary code with the agent's elevated privileges on managed endpoints. In practice, exploitation requires the attacker to intercept, modify, or impersonate the data/update channel the agent trusts (e.g., adversary-in-the-middle or rogue server), meaning the vendor's low-complexity rating (CVSS 9.8) is tempered by this positioning requirement. No public exploit code has been identified at time of analysis, and there is no indication of active exploitation (not in CISA KEV).
An authenticated attacker can bypass the restore-archive prefix validation in the parame_put_file.cgi handler of Netcore NR268 firmware 1.7.121109, allowing a crafted configuration-restore archive to write files outside the intended restore path. The flaw yields a high integrity and availability impact — device configuration can be overwritten or unset, and the router can be left in an unusable state — while confidentiality is unaffected per the CVSS 4.0 vector (VC:N/VI:H/VA:H). No public exploit code or CISA KEV entry has been identified at time of analysis, and no vendor-released patch is referenced in the available advisories.
Integrity tampering in Thermo Fisher Applied Biosystems Genetic Analyzers allows any user with local file system access to silently modify .fsa and .hid output files - the raw DNA sequence and fragment analysis data produced by these instruments - because no cryptographic integrity check (CWE-353) is applied to these files. Affected products span eight distinct data collection and analysis software lines, including the forensic-grade GeneMapper ID-X platform, meaning tampered files could propagate falsified DNA profiles into criminal proceedings or clinical diagnostics without detection. No public exploit code has been identified at time of analysis, and exploitation is covered by CISA ICS Medical Advisory ICSMA-26-216-01.
Persistent local code execution affects Anthropic Claude Desktop Cowork on macOS (v1.1348.0 through v1.2278.0) because the Cowork VM bootstrap validates only the presence of rootfs.img and a version marker string without verifying image content integrity at time-of-use. A local attacker with unprivileged code execution as the victim user can swap or modify the root filesystem image so subsequent Cowork VM boots trust the tampered image, yielding persistent arbitrary code execution inside the VM and access to host-mounted directories. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Missing integrity verification in OpenClaw before 2026.4.8 (npm package 'openclaw', tracked by the vendor as B-M3) lets attackers deliver tampered or malicious ClawHub plugin archives that install without any archive- or per-file integrity check, compromising the local assistant environment. The flaw was reported by VulnCheck and Tencent Zhuque Lab and is fixed in 2026.4.8; there is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 4th percentile). Because OpenClaw is a user-controlled local assistant, exploitation requires the victim to install a plugin whose download an attacker can substitute or tamper with.
Checkmarx ast-cli through 2.3.59 fetches the Vorpal ASCA real-time engine and SCA Resolver helper binaries from download.checkmarx.com during its auto-update flow and extracts and executes them without verifying a checksum, so an attacker who could substitute the served archive could get an arbitrary binary executed on developer machines and CI runners. Triggering the vulnerable path requires either a developer using the Checkmarx VSCode/JetBrains extension (which invokes ASCA) or someone running 'cx scan sca-realtime' on an affected version, and exploitation further requires control of the vendor's download endpoint or interception of the download - a high, attacker-uncontrolled barrier reflected in the elevated attack complexity. The vendor has released 2.3.60, which verifies the download against a published SHA-256 checksum before extraction; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), placing it in the this_month priority bucket.
Network traffic integrity can be silently undermined on unpatched Apple platforms - iOS and iPadOS before 27, macOS Golden Gate before 27, tvOS before 27, and watchOS before 27 - by an unauthenticated attacker who already holds a privileged on-path network position between the device and its peer. Apple fixed the underlying cryptographic weakness through improved integrity checks in the 27-generation releases, restoring the guarantee that intercepted traffic cannot be modified undetected. Exploitation is constrained by the adjacency requirement (AV:A) and high attack complexity (AC:H), EPSS is only 0.17% (7th percentile), and no public exploit code has been identified at time of analysis.
Replay attack vulnerability in WeenyGenius, a computer lab management system by Howyar Technologies, allows unauthenticated adjacent-network attackers to forge student attendance status. By intercepting a legitimate student connection packet and replaying it, an attacker can make the management system believe the student remains connected after they have disconnected. No public exploit has been identified at time of analysis, and EPSS data is not available for this entry.
Arbitrary code execution in Dell ThinOS 10 (all builds prior to 2605_10.2616) is enabled by a missing integrity check (CWE-353) that allows a local high-privileged attacker to substitute unverified code or data in a load path the OS processes without cryptographic validation. Dell advisory DSA-2026-389 confirms both the vulnerability and a corrective update. No public exploit code or CISA KEV listing exists at time of analysis, limiting real-world risk to targeted insider-threat or physical-access scenarios.
Missing integrity verification in the HPE Networking ClearPass Policy Manager client agent allows remote unauthenticated attackers to introduce untrusted code that the agent then executes on the enrolled client system, giving full code execution on that endpoint. Only systems running the vulnerable client agent (for example OnGuard deployments) are exposed; the ClearPass server itself is not the target of this flaw, and organizations that do not deploy the agent are unaffected. The input CVSS of 9.8 reflects the worst case, but the authoritative independent assessment scores it AV:N/AC:H, because the attacker must first be able to supply or substitute the code the agent consumes - typically a man-in-the-middle position on the agent's communication or update channel, or control of a source the agent implicitly trusts. There is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so the practical risk is conditional on the attacker obtaining that network positioning or trusted-source access.
Missing integrity verification in the HPE ClearPass Policy Manager OnGuard agent allows an unauthenticated, remote attacker to execute arbitrary code with the agent's elevated privileges on managed endpoints. In practice, exploitation requires the attacker to intercept, modify, or impersonate the data/update channel the agent trusts (e.g., adversary-in-the-middle or rogue server), meaning the vendor's low-complexity rating (CVSS 9.8) is tempered by this positioning requirement. No public exploit code has been identified at time of analysis, and there is no indication of active exploitation (not in CISA KEV).
An authenticated attacker can bypass the restore-archive prefix validation in the parame_put_file.cgi handler of Netcore NR268 firmware 1.7.121109, allowing a crafted configuration-restore archive to write files outside the intended restore path. The flaw yields a high integrity and availability impact — device configuration can be overwritten or unset, and the router can be left in an unusable state — while confidentiality is unaffected per the CVSS 4.0 vector (VC:N/VI:H/VA:H). No public exploit code or CISA KEV entry has been identified at time of analysis, and no vendor-released patch is referenced in the available advisories.
Integrity tampering in Thermo Fisher Applied Biosystems Genetic Analyzers allows any user with local file system access to silently modify .fsa and .hid output files - the raw DNA sequence and fragment analysis data produced by these instruments - because no cryptographic integrity check (CWE-353) is applied to these files. Affected products span eight distinct data collection and analysis software lines, including the forensic-grade GeneMapper ID-X platform, meaning tampered files could propagate falsified DNA profiles into criminal proceedings or clinical diagnostics without detection. No public exploit code has been identified at time of analysis, and exploitation is covered by CISA ICS Medical Advisory ICSMA-26-216-01.
Persistent local code execution affects Anthropic Claude Desktop Cowork on macOS (v1.1348.0 through v1.2278.0) because the Cowork VM bootstrap validates only the presence of rootfs.img and a version marker string without verifying image content integrity at time-of-use. A local attacker with unprivileged code execution as the victim user can swap or modify the root filesystem image so subsequent Cowork VM boots trust the tampered image, yielding persistent arbitrary code execution inside the VM and access to host-mounted directories. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Missing integrity verification in OpenClaw before 2026.4.8 (npm package 'openclaw', tracked by the vendor as B-M3) lets attackers deliver tampered or malicious ClawHub plugin archives that install without any archive- or per-file integrity check, compromising the local assistant environment. The flaw was reported by VulnCheck and Tencent Zhuque Lab and is fixed in 2026.4.8; there is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 4th percentile). Because OpenClaw is a user-controlled local assistant, exploitation requires the victim to install a plugin whose download an attacker can substitute or tamper with.
Checkmarx ast-cli through 2.3.59 fetches the Vorpal ASCA real-time engine and SCA Resolver helper binaries from download.checkmarx.com during its auto-update flow and extracts and executes them without verifying a checksum, so an attacker who could substitute the served archive could get an arbitrary binary executed on developer machines and CI runners. Triggering the vulnerable path requires either a developer using the Checkmarx VSCode/JetBrains extension (which invokes ASCA) or someone running 'cx scan sca-realtime' on an affected version, and exploitation further requires control of the vendor's download endpoint or interception of the download - a high, attacker-uncontrolled barrier reflected in the elevated attack complexity. The vendor has released 2.3.60, which verifies the download against a published SHA-256 checksum before extraction; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), placing it in the this_month priority bucket.
Network traffic integrity can be silently undermined on unpatched Apple platforms - iOS and iPadOS before 27, macOS Golden Gate before 27, tvOS before 27, and watchOS before 27 - by an unauthenticated attacker who already holds a privileged on-path network position between the device and its peer. Apple fixed the underlying cryptographic weakness through improved integrity checks in the 27-generation releases, restoring the guarantee that intercepted traffic cannot be modified undetected. Exploitation is constrained by the adjacency requirement (AV:A) and high attack complexity (AC:H), EPSS is only 0.17% (7th percentile), and no public exploit code has been identified at time of analysis.
Replay attack vulnerability in WeenyGenius, a computer lab management system by Howyar Technologies, allows unauthenticated adjacent-network attackers to forge student attendance status. By intercepting a legitimate student connection packet and replaying it, an attacker can make the management system believe the student remains connected after they have disconnected. No public exploit has been identified at time of analysis, and EPSS data is not available for this entry.
Arbitrary code execution in Dell ThinOS 10 (all builds prior to 2605_10.2616) is enabled by a missing integrity check (CWE-353) that allows a local high-privileged attacker to substitute unverified code or data in a load path the OS processes without cryptographic validation. Dell advisory DSA-2026-389 confirms both the vulnerability and a corrective update. No public exploit code or CISA KEV listing exists at time of analysis, limiting real-world risk to targeted insider-threat or physical-access scenarios.