CVE-2026-53970 | High | 7.5 | 2026-08-14 | ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execut… |
CVE-2026-13433 | High | 8.3 | 2026-08-12 | IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A ba… |
CVE-2026-48046 | | | 2026-08-11 | Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulne… |
CVE-2026-0392 | | | 2026-08-03 | eParakstītājs 3.0 for Windows before version
1.10.0 retrieves and executes its automatic updates over a channel that is not
authenticated or integrity-protecte… |
CVE-2026-12259 | Medium | 5.3 | 2026-08-03 | In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforc… |
CVE-2026-66398 | | | 2026-07-27 | phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT… |
CVE-2026-50562 | | | 2026-07-15 | FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, artifacts built from untrusted pull reque… |
CVE-2021-47987 | High | 7.5 | 2026-06-25 | Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unrevi… |
CVE-2021-47986 | High | 7.5 | 2026-06-25 | Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a per… |
CVE-2026-55698 | High | 8.8 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap metadata in the first YAML document of pnpm-lock.yaml. Befor… |
CVE-2026-55697 | High | 7.5 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.yaml before command dispatch. Before the… |
CVE-2026-49241 | High | 8.8 | 2026-06-22 | The Angular Language Service VS Code Extension provides a rich editing experience for Angular templates. Prior to 21.2.4, the client-side Angular Language Serv… |
CVE-2026-9037 | | | 2026-05-28 | A firmware update mechanism in the affected charging controller fails to validate the authenticity of firmware packages delivered through the device's manageme… |
CVE-2026-45058 | | | 2026-05-28 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In 3.8.8 and earlier, there is persistent local-pty code execution vi… |
CVE-2026-9089 | High | 8.8 | 2026-05-21 | The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is a… |
CVE-2026-42575 | High | 7.5 | 2026-05-09 | apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but… |
CVE-2026-32148 | Medium | 5.9 | 2026-04-30 | Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfi… |
CVE-2026-42249 | Critical | 9.8 | 2026-04-29 | Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker‑controlled HTTP response headers… |
CVE-2026-42248 | Critical | 9.8 | 2026-04-29 | Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike other platforms, the Windows implementation… |
CVE-2025-10539 | Medium | 4.8 | 2026-04-28 | Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path… |
CVE-2026-40066 | High | 8.8 | 2026-04-17 | Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and executes a script resulting in unauthenticated… |
CVE-2026-3428 | | | 2026-04-16 | A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member Center(华硕大厅) allows a local user to achieve privilege escalation… |
CVE-2026-34841 | Critical | 9.8 | 2026-04-06 | Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the a… |
CVE-2026-30603 | Medium | 6.8 | 2026-04-02 | An issue in the firmware update mechanism of Qianniao QN-L23PA0904 v20250721.1640 allows attackers to gain root access, install backdoors, and exfiltrate data… |
CVE-2026-3502 | High | 7.8 | 2026-03-30 | TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path… |
CVE-2026-33075 | High | 8.8 | 2026-03-20 | FastGPT is an AI Agent building platform. In versions 4.14.8.3 and below, the fastgpt-preview-image.yml workflow is vulnerable to arbitrary code execution and… |
CVE-2026-28500 | High | 8.6 | 2026-03-18 | Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypas… |
CVE-2026-1878 | | | 2026-03-12 | An Insufficient Integrity Verification vulnerability in the ASUS ROG peripheral driver installation process allows privilege escalation to SYSTEM. The vulnerab… |
CVE-2026-3000 | Critical | 9.8 | 2026-03-02 | IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to… |
CVE-2026-2999 | Critical | 9.8 | 2026-03-02 | IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to… |
CVE-2025-47904 | Medium | 4.1 | 2026-02-24 | Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider… |
CVE-2026-27180 | Critical | 9.8 | 2026-02-18 | MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The save… |
CVE-2025-15575 | Medium | 5.3 | 2026-02-12 | The firmware update functionality does not verify the authenticity of the supplied firmware update files. This allows attackers to flash malicious firmware upd… |
CVE-2026-25961 | High | 7.5 | 2026-02-09 | SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification (INTERNET_FLAG_IGNORE… |
CVE-2026-20056 | Medium | 4.0 | 2026-02-04 | A vulnerability in the Dynamic Vectoring and Streaming (DVS) Engine implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unau… |
CVE-2025-15556 | High | 7.5 | 2026-02-03 | Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and i… |
CVE-2026-22865 | High | 7.4 | 2026-01-16 | Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, s… |
CVE-2026-22816 | High | 7.4 | 2026-01-16 | Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, s… |
CVE-2025-69263 | High | 7.5 | 2026-01-07 | pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. This… |
CVE-2025-68109 | Critical | 9.1 | 2025-12-17 | ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file exte… |
CVE-2025-65855 | Medium | 6.6 | 2025-12-17 | The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard-coded WiFi credentials identical across… |
CVE-2025-55310 | High | 7.3 | 2025-12-11 | An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. An attacker able to alter or replace the static HTML… |
CVE-2025-14265 | Critical | 9.1 | 2025-12-11 | In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execut… |
CVE-2025-66334 | Low | 3.3 | 2025-12-08 | Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-66333 | Low | 3.3 | 2025-12-08 | Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-66332 | Low | 3.3 | 2025-12-08 | Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-66331 | Low | 3.3 | 2025-12-08 | Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-61228 | High | 7.8 | 2025-12-01 | An issue in Shirt Pocket SuperDuper! V.3.10 and before allows a local attacker to execute arbitrary code via the software update mechanism |
CVE-2025-63434 | High | 8.8 | 2025-11-24 | The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure. The application downloads and extracts update packages conta… |
CVE-2025-40604 | Critical | 9.8 | 2025-11-20 | Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, all… |
CVE-2025-63220 | High | 7.2 | 2025-11-19 | The Sound4 FIRST web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package. The update mechanism fail… |
CVE-2025-63215 | High | 7.2 | 2025-11-18 | The Sound4 IMPACT web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package. The update mechanism fai… |
CVE-2025-52263 | High | 8.0 | 2025-10-27 | An issue in the Web Configuration module of Startcharge Artemis AC Charger 7-22 kW v1.0.4 allows authenticated network-adjacent attackers to upload crafted fir… |
CVE-2025-11493 | High | 8.8 | 2025-10-16 | The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. Thi… |
CVE-2025-11182 | Medium | 6.5 | 2025-10-02 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Download of Code Without Integrity Check vulnerability in GTONE ChangeFlow allo… |
CVE-2025-56513 | Critical | 9.8 | 2025-09-30 | NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks. An attacker capable of intercepting or redi… |
CVE-2025-34212 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.843 and Application prior to version 20.0.1923 (VA/SaaS deployments) possess … |
CVE-2025-57431 | High | 8.8 | 2025-09-22 | The Sound4 PULSE-ECO AES67 1.22 web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package. The update… |
CVE-2025-9319 | High | 7.5 | 2025-09-11 | A potential vulnerability was reported in the Lenovo Wallpaper Client that could allow arbitrary code execution under certain conditions. |
CVE-2025-30199 | High | 7.2 | 2025-09-05 | ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air updates can be sent to base station via insecure connection betw… |
CVE-2025-55582 | Medium | 6.6 | 2025-08-27 | D-Link DCS-825L firmware v1.08.01 contains a vulnerability in the watchdog script `mydlink-watch-dog.sh`, which blindly respawns binaries such as `dcp` and `si… |
CVE-2025-35115 | High | 8.1 | 2025-08-26 | Agiloft Release 28 downloads critical system packages over an insecure HTTP connection. An attacker in a Man-In-the-Middle position could replace or modify the… |
CVE-2024-47192 | Medium | 5.3 | 2025-08-26 | An issue was discovered in Mahara 23.04.8 and 24.04.4. The use of a malicious export download URL can allow an attacker to download files that they do not have… |
CVE-2025-55581 | High | 7.3 | 2025-08-22 | D-Link DCS-825L firmware version 1.08.01 and possibly prior versions contain an insecure implementation in the mydlink-watch-dog.sh script. The script monitors… |
CVE-2025-31355 | High | 7.2 | 2025-08-20 | A firmware update vulnerability exists in the Firmware Signature Validation functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted malicious file c… |
CVE-2025-53520 | High | 8.8 | 2025-08-08 | The affected product allows firmware updates to be downloaded from EG4's
website, transferred via USB dongles, or installed through EG4's
Monitoring Center (… |
CVE-2025-53696 | | | 2025-07-28 | iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firmware parts may cont… |
CVE-2025-7620 | High | 8.8 | 2025-07-14 | The cross-browser document creation component produced by Digitware System Integration Corporation has a Remote Code Execution vulnerability. If a user visits… |
CVE-2025-52937 | | | 2025-06-23 | Vulnerability in PointCloudLibrary PCL (surface/src/3rdparty/opennurbs modules). This vulnerability is associated with program files crc32.C.
This vulnerabili… |
CVE-2025-28236 | Critical | 9.8 | 2025-04-18 | Nautel VX Series transmitters VX SW v6.4.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the firmware update process. This… |
CVE-2025-27593 | Critical | 9.3 | 2025-03-14 | The product can be used to distribute malicious code using SDD Device Drivers due to missing download verification checks, leading to code execution on target… |
CVE-2024-43169 | High | 8.8 | 2025-03-03 | IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a user to download a malicious file without verifying the integrity of the… |
CVE-2024-50696 | High | 7.5 | 2025-02-26 | SunGrow WiNet-S V200.001.00.P025 and earlier versions is missing integrity checks for firmware upgrades. Sending a specific MQTT message allows an update to an… |
CVE-2025-1058 | High | 8.1 | 2025-02-13 | CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device
inoperable when malicious firmware is downloaded. |
CVE-2024-52331 | High | 7.5 | 2025-01-23 | ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that… |
CVE-2024-42183 | Low | 2.5 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability. It could allow a malicious operator to download files from arbitrary… |
CVE-2024-55459 | Medium | 6.5 | 2025-01-08 | An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_file function. |
CVE-2024-54126 | | | 2024-12-05 | This vulnerability exists in the TP-Link Archer C50 due to improper signature verification mechanism in the firmware upgrade process at its web interface. An a… |
CVE-2024-52583 | High | 8.2 | 2024-11-18 | The WesHacks GitHub repository provides the official Hackathon competition website source code for the Muweilah Wesgreen Hackathon. The page `schedule.html` be… |
CVE-2024-48974 | Critical | 9.3 | 2024-11-14 | The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force unauthorized chang… |
CVE-2024-33660 | Medium | 4.3 | 2024-11-12 | An exploit is possible where an actor with physical access can manipulate SPI flash without being detected. |
CVE-2024-45321 | High | 8.1 | 2024-08-27 | The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers. |
CVE-2024-39819 | Medium | 6.7 | 2024-07-15 | Integrity check in the installer for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct a privilege escalation via local… |
CVE-2023-41921 | Critical | 9.8 | 2024-07-02 | A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin… |
CVE-2024-39348 | High | 7.5 | 2024-06-28 | Download of code without integrity check vulnerability in AirPrint functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1.3.1-9346-8 allows… |
CVE-2024-30206 | High | 8.8 | 2024-05-14 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (… |
CVE-2024-33118 | High | 7.5 | 2024-05-06 | LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary read vulnerability via the fileDownload method in class com.luckyframe.project.common.CommonControl… |
CVE-2023-39474 | High | 8.8 | 2024-05-03 | Inductive Automation Ignition downloadLaunchClientJar Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2024-28878 | Critical | 9.6 | 2024-04-12 |
IO-1020 Micro ELD downloads source code or an executable from an
adjacent location and executes the code without sufficiently verifying
the origin or integr… |
CVE-2024-28850 | High | 8.1 | 2024-03-25 | WP Crontrol controls the cron events on WordPress websites. WP Crontrol includes a feature that allows administrative users to create events in the WP-Cron sy… |
CVE-2024-30205 | High | 7.1 | 2024-03-25 | In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23. |
CVE-2024-27438 | Critical | 9.8 | 2024-03-21 | Download of Code Without Integrity Check vulnerability in Apache Doris.
The jdbc driver files used for JDBC catalog is not checked and may resulting in remote… |
CVE-2023-47353 | High | 8.8 | 2024-02-06 | An issue in the com.oneed.dvr.service.DownloadFirmwareService component of IMOU GO v1.0.11 allows attackers to force the download of arbitrary files. |
CVE-2023-5592 | High | 7.5 | 2023-12-14 | Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR (SDK) allows an unauthenticated remote attac… |
CVE-2023-46144 | Medium | 6.5 | 2023-12-14 | A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affec… |
CVE-2023-46143 | High | 7.5 | 2023-12-14 | Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all app… |
CVE-2023-5630 | Medium | 6.5 | 2023-12-14 |
A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a
privileged user to install an untrusted firmware.
|
CVE-2023-45842 | High | 8.1 | 2023-12-05 | Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A special… |
CVE-2023-45841 | High | 8.1 | 2023-12-05 | Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A special… |
CVE-2023-45840 | High | 8.1 | 2023-12-05 | Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A special… |