# CWE-494.

Every Advisory and CVE whose sources give the weakness CWE-494, newest first.

## Records, newest first

- [nvm install --offline installs a cached tarball that previously failed checksum verification](https://agentprime.io/advisories/CVE-2026-121750.md)
  `CVE-2026-121750` · CVE record: nvm-sh nvm · CVSS 2.1 Low · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-459, CWE-494
- [Signed plug-in validation bypass](https://agentprime.io/advisories/CVE-2026-110022.md)
  `CVE-2026-110022` · CVE record: Phoenix Contact PLCnext Engineer · CVSS 8.6 High · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-494
- [Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification](https://agentprime.io/advisories/CVE-2026-92092.md)
  `CVE-2026-92092` · CVE record: Red Hat Red Hat OpenShift Container Platform 4 and 1 more · CVSS 7.4 High · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-494
- [Download of code without integrity check in Apple container and others](https://agentprime.io/advisories/CVE-2026-113957.md)
  `CVE-2026-113957` · CVE record: Apple container and 1 more · CVSS 5.6 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-494
- [virtualenv: Pip seeding with download omits wheel digest verification](https://agentprime.io/advisories/GHSA-cx28-75q4-x26q.md)
  `GHSA-cx28-75q4-x26q`, `BIT-virtualenv-2026-113717`, `CVE-2026-113717` · PyPI `virtualenv`: affected `<21.14.9`, fixed in `21.14.9` · CVSS 2.3 Low · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-494
- [Firmware verification vulnerability](https://agentprime.io/advisories/CVE-2026-55981.md)
  `CVE-2026-55981` · CVE record: Creative Labs Creative Sound Blaster Katana V2, V2X, SE · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-494
- [EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks](https://agentprime.io/advisories/CVE-2026-105036.md)
  `CVE-2026-105036` · CVE record: EnergizeLab Robot firmware (mode 104000) and 2 more · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-494
- [Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning](https://agentprime.io/advisories/GHSA-pq7j-f95f-qfcv.md)
  `GHSA-pq7j-f95f-qfcv`, `CVE-2026-86063` · npm `@anthropic-ai/claude-code`: affected `<2.1.179`, fixed in `2.1.179` · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-494, CWE-829
- [Download of code without integrity check in Eclipse Foundation Adoptium Temurin](https://agentprime.io/advisories/CVE-2026-93649.md)
  `CVE-2026-93649` · CVE record: Eclipse Foundation Adoptium Temurin · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Open redirect, CWE-494
- [powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer](https://agentprime.io/advisories/CVE-2026-110102.md)
  `CVE-2026-110102` · CVE record: romkatv powerlevel10k · CVSS 7.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-494
- [Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM](https://agentprime.io/advisories/GHSA-662p-52hx-cmh2.md)
  `GHSA-662p-52hx-cmh2`, `CVE-2026-107812`, `GO-2026-6705` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728114330-580585516dd8`, fixed in `1.9.10-0.20260728114330-580585516dd8` · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-494
- [AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed](https://agentprime.io/advisories/CVE-2026-108160.md)
  `CVE-2026-108160` · CVE record: iflytek astron-rpa · CVSS 7.7 High · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-494
- [Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Check](https://agentprime.io/advisories/CVE-2026-29797.md)
  `CVE-2026-29797` · CVE record: Red Lion Controls 700 Series · CVSS 8.4 High · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-494
- [Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution](https://agentprime.io/advisories/CVE-2026-104809.md)
  `CVE-2026-104809` · CVE record: Mitel Mitel MiVoice Office 400 · CVSS 8.4 High · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal, CWE-426, CWE-427, CWE-494
- [Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Execution](https://agentprime.io/advisories/CVE-2026-104805.md)
  `CVE-2026-104805` · CVE record: Mitel Mitel MiVoice Office 400 · CVSS 8.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal, Unrestricted file upload, CWE-345, CWE-494
- [GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass](https://agentprime.io/advisories/CVE-2026-105295.md)
  `CVE-2026-105295` · CVE record: gitahead GitAhead · CVSS 7.7 High · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-494
- [Laradock Build Process Dockerfile code download](https://agentprime.io/advisories/CVE-2026-105137.md)
  `CVE-2026-105137` · CVE record: Laradock · CVSS 2.3 Low · Not analysed yet · Published 4 Oct 2026 · Tags: CWE-494
- [NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files](https://agentprime.io/advisories/CVE-2026-55251.md)
  `CVE-2026-55251` · CVE record: netbox-community devicetype-library · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Code injection, CWE-494, CWE-829
- [virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use](https://agentprime.io/advisories/GHSA-94p9-xgh2-xp45.md)
  `GHSA-94p9-xgh2-xp45`, `BIT-virtualenv-2026-102930`, `CVE-2026-102930`, `PYSEC-2026-4011` · PyPI `virtualenv`: affected `<21.7.12`, fixed in `21.7.12` · CVSS 7.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-494
- [Download of code without integrity check in JetBrains Rider](https://agentprime.io/advisories/CVE-2026-100265.md)
  `CVE-2026-100265` · CVE record: JetBrains Rider · CVSS 4.8 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-494
- [Download of code without integrity check in Dell Secure Connect Gateway (SCG) Policy Manager](https://agentprime.io/advisories/CVE-2026-73595.md)
  `CVE-2026-73595` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 4.7 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-494
- [Reachy Mini daemon allows unauthenticated remote code execution through the app installation endpoint](https://agentprime.io/advisories/CVE-2026-96455.md)
  `CVE-2026-96455` · CVE record: Pollen Robotics Reachy Mini · CVSS 8.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Authentication bypass, CWE-494
- [Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName](https://agentprime.io/advisories/CVE-2026-49450.md)
  `CVE-2026-49450` · CVE record: laurent22 joplin · CVSS 7.1 High · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-345, CWE-353, CWE-494
- [spatie Scotty Self Update SelfUpdater.php update code download](https://agentprime.io/advisories/CVE-2026-93534.md)
  `CVE-2026-93534` · CVE record: spatie Scotty · CVSS 5.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-494
- [Sublime Text 4192/3207 Local Privilege Escalation via Update Staging Mechanism](https://agentprime.io/advisories/CVE-2026-7006.md)
  `CVE-2026-7006` · CVE record: Sublime HQ Pty Ltd Sublime Text 4 and 1 more · CVSS 7.0 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-494
- [Download of code without integrity check in Jenkins Project Jenkins Script Security Plugin](https://agentprime.io/advisories/CVE-2026-92128.md)
  `CVE-2026-92128` · CVE record: Jenkins Project Jenkins Script Security Plugin · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-494
- [Download of code without integrity check in Dell SmartFabric OS10 Software](https://agentprime.io/advisories/CVE-2026-63696.md)
  `CVE-2026-63696` · CVE record: Dell SmartFabric OS10 Software · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-494
- [Download of code without integrity check in Dell ThinOS 10](https://agentprime.io/advisories/CVE-2026-81052.md)
  `CVE-2026-81052` · CVE record: Dell ThinOS 10 · CVSS 6.8 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: CWE-494
- [Download of code without integrity check in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-79963.md)
  `CVE-2026-79963` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 7.4 High · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-494
- [NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection](https://agentprime.io/advisories/GHSA-5wp5-5229-5g6q.md)
  `GHSA-5wp5-5229-5g6q`, `CVE-2026-12259`, `CVE-2026-63310`, `GHSA-gf32-cmjh-8m9v`, `PYSEC-2026-3729`, `PYSEC-2026-4318` · PyPI `nltk`: affected `<3.9.3`, fixed in `3.9.3` · CVSS 5.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-494
- [Download of code without integrity check in Siemens Reyrolle 7SR5](https://agentprime.io/advisories/CVE-2026-62654.md)
  `CVE-2026-62654` · CVE record: Siemens Reyrolle 7SR5 · CVSS 7.0 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-494
- [MOOS essential-moos through 10.0.1 pAntler Remote Code Execution via Unauthenticated MISSION_FILE](https://agentprime.io/advisories/CVE-2026-85427.md)
  `CVE-2026-85427` · CVE record: themoos essential-moos · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-494
- [Improper input validation in Jenkins Project Jenkins Job Configuration History Plugin](https://agentprime.io/advisories/CVE-2026-84666.md)
  `CVE-2026-84666` · CVE record: Jenkins Project Jenkins Job Configuration History Plugin · CVSS 5.4 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-20, CWE-494
- [Download of code without integrity check in Jenkins Project Jenkins GitLab Plugin](https://agentprime.io/advisories/CVE-2026-84664.md)
  `CVE-2026-84664` · CVE record: Jenkins Project Jenkins GitLab Plugin · CVSS 5.4 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-471, CWE-494
- [Hugging Face Transformers downloads custom generation code before trust consent](https://agentprime.io/advisories/GHSA-x9r9-c232-4q39.md)
  `GHSA-x9r9-c232-4q39`, `CVE-2026-80047`, `PYSEC-2026-4174` · PyPI `transformers`: affected `>=4.49.0, <=5.8.1`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Race condition, CWE-273, CWE-494
- [Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference](https://agentprime.io/advisories/CVE-2026-82021.md)
  `CVE-2026-82021` · CVE record: NousResearch hermes-agent · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-494
- [Spring for GraphQL loads Untrusted Resources in GraphiQL support](https://agentprime.io/advisories/CVE-2026-59286.md)
  `CVE-2026-59286` · CVE record: Spring Spring for GraphQL · CVSS 8.1 High · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-494
- [An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.e…](https://agentprime.io/advisories/CVE-2026-30612.md)
  `CVE-2026-30612` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-494
- [HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and downloading code without integrity checking](https://agentprime.io/advisories/CVE-2026-21810.md)
  `CVE-2026-21810` · CVE record: HCLSoftware BigFix Quantum Risk Analyzer · CVSS 4.4 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-494, CWE-610
- [Download of code without integrity check in NVIDIA NemoClaw](https://agentprime.io/advisories/CVE-2026-65081.md)
  `CVE-2026-65081` · CVE record: NVIDIA NemoClaw · CVSS 8.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-494
- [Download of code without integrity check in NVIDIA NemoClaw](https://agentprime.io/advisories/CVE-2026-65097.md)
  `CVE-2026-65097` · CVE record: NVIDIA NemoClaw · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-494
- [WatchGuard Agent improper authentication allows unauthenticated remote code execution](https://agentprime.io/advisories/CVE-2026-57910.md)
  `CVE-2026-57910` · CVE record: WatchGuard WatchGuard Agent · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass, Weak cryptography or TLS, CWE-494
- [Critical flaw impacting OZOLS ERP's automatic update channel](https://agentprime.io/advisories/CVE-2026-22306.md)
  `CVE-2026-22306` · CVE record: Ozols Grupa OZOLS · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Weak cryptography or TLS, CWE-494, CWE-829
- [atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)](https://agentprime.io/advisories/GHSA-xhcr-cqfr-m3hv.md)
  `GHSA-xhcr-cqfr-m3hv`, `CVE-2026-91988` · PyPI `atomic-agents-stack`: affected `<1.1.0`, fixed in `1.1.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Aug 2026 · Tags: Weak cryptography or TLS, CWE-494
- [ZeroBrew version 0.3.1 and prior Missing Checksum Verification RCE via shim.rb](https://agentprime.io/advisories/CVE-2026-53970.md)
  `CVE-2026-53970` · CVE record: lucasgelfond ZeroBrew · CVSS 7.5 High · Not analysed yet · Published 14 Aug 2026 · Tags: CWE-494
- [IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-13433.md)
  `CVE-2026-13433` · CVE record: IBM i Access Client Solutions · CVSS 8.3 High · Not analysed yet · Published 12 Aug 2026 · Tags: CWE-494
- [Streambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC Handler](https://agentprime.io/advisories/CVE-2026-48046.md)
  `CVE-2026-48046` · CVE record: truelockmc streambert · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-494
- [eParakstītājs 3.0 for Windows – remote code execution via unauthenticated auto-update](https://agentprime.io/advisories/CVE-2026-0392.md)
  `CVE-2026-0392` · CVE record: Latvijas Valsts radio un televīzijas centrs (LVRTC) eParakstītājs 3.0 · CVSS 7.3 High · Not analysed yet · Published 3 Aug 2026 · Tags: Weak cryptography or TLS, CWE-494
- [Duplicate Advisory: NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection](https://agentprime.io/advisories/GHSA-pv39-qrfq-g8gc.md)
  `GHSA-pv39-qrfq-g8gc` · PyPI `nltk`: affected `<=3.9.2`, no fixed version yet · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-494
- [phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API](https://agentprime.io/advisories/CVE-2026-66398.md)
  `CVE-2026-66398` · CVE record: thorsten phpMyFAQ · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jul 2026 · Tags: CWE-494
- [FastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflows](https://agentprime.io/advisories/CVE-2026-50562.md)
  `CVE-2026-50562` · CVE record: labring FastGPT · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jul 2026 · Tags: Privilege escalation, CWE-494, CWE-829
- [pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes](https://agentprime.io/advisories/GHSA-w466-c33r-3gjp.md)
  `GHSA-w466-c33r-3gjp`, `CVE-2026-55698` · npm `pnpm`: affected `<10.34.2 || >=11.0.0, <11.5.3`, fixed in `10.34.2`, `11.5.3` · CVSS 8.8 High · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-345, CWE-494, CWE-829
- [pnpm: Repository-controlled configDependencies can select a pacquet native install engine](https://agentprime.io/advisories/GHSA-gj8w-mvpf-x27x.md)
  `GHSA-gj8w-mvpf-x27x`, `CVE-2026-55697` · npm `pnpm`: affected `<10.34.2 || >=11.0.0, <11.5.3`, fixed in `10.34.2`, `11.5.3` · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: Command injection, CWE-494, CWE-829
- [Angular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension](https://agentprime.io/advisories/CVE-2026-49241.md)
  `CVE-2026-49241` · CVE record: angular angular · CVSS 8.7 High · Not analysed yet · Published 22 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection, CWE-427, CWE-494
- [Withdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY](https://agentprime.io/advisories/GHSA-gv7w-rqvm-qjhr.md)
  `GHSA-gv7w-rqvm-qjhr` · npm `esbuild`: affected `>=0.17.0, <0.28.1`, fixed in `0.28.1` · CVSS 8.1 High · Withdrawn · Not analysed yet · Published 12 Jun 2026 · Tags: CWE-426, CWE-494
- [stigmem-node's unsigned plugin override could be enabled without a second explicit acknowledgment](https://agentprime.io/advisories/GHSA-w7pm-9g55-mxfm.md)
  `GHSA-w7pm-9g55-mxfm`, `CVE-2026-76241` · PyPI `stigmem-node`: affected `<0.9.0a2`, fixed in `0.9.0a2` · CVSS 7.3 High · Not analysed yet · Published 29 May 2026 · Tags: CWE-494
- [Download of code without integrity check in XCharge C6](https://agentprime.io/advisories/CVE-2026-9037.md)
  `CVE-2026-9037` · CVE record: XCharge C6 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2026 · Tags: CWE-494
- [Download of code without integrity check in ConnectWise Automate](https://agentprime.io/advisories/CVE-2026-9089.md)
  `CVE-2026-9089` · CVE record: ConnectWise Automate · CVSS 8.8 High · Not analysed yet · Published 21 May 2026 · Tags: CWE-494
- [Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark](https://agentprime.io/advisories/GHSA-jgg9-rw32-44pj.md)
  `GHSA-jgg9-rw32-44pj`, `CVE-2026-45058` · npm `electerm`: affected `<=3.8.8`, no fixed version yet · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2026 · Tags: Code injection, Broken access control, CWE-345, CWE-494
- [apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)](https://agentprime.io/advisories/GHSA-hcwr-pq9g-rq3m.md)
  `GHSA-hcwr-pq9g-rq3m`, `CVE-2026-42575`, `GO-2026-5422` · Go `chainguard.dev/apko`: affected `<1.2.7`, fixed in `1.2.7` · CVSS 7.5 High · Not analysed yet · Published 4 May 2026 · Tags: CWE-345, CWE-494

Older: <https://agentprime.io/advisories/tag/cwe-494.md?cursor=WyIyMDI2LTA1LTA0VDIxOjI3OjE3LjAwMDAwMFoiLCJHSFNBLWhjd3ItcHE5Zy1ycTNtIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-494>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-494/>. Everything for agents: <https://agentprime.io/llms.txt>.