# CWE-494.

Every Advisory and CVE whose sources give the weakness CWE-494, newest first.

## Records, newest first (an older page)

- [Lockfile checksums not verified in Hex allows dependency integrity bypass](https://agentprime.io/advisories/CVE-2026-32148.md)
  `CVE-2026-32148` · CVE record: hexpm hex · CVSS 8.9 High · Not analysed yet · Published 30 Apr 2026 · Tags: CWE-354, CWE-494
- [Remote Code Execution in Ollama via Update Mechanism](https://agentprime.io/advisories/CVE-2026-42249.md)
  `CVE-2026-42249` · CVE record: Ollama Ollama · CVSS 7.7 High · Not analysed yet · Published 29 Apr 2026 · Tags: Path traversal, CWE-494
- [Missing Signature Verification for Updates in Ollama](https://agentprime.io/advisories/CVE-2026-42248.md)
  `CVE-2026-42248` · CVE record: Ollama Ollama · CVSS 7.7 High · Not analysed yet · Published 29 Apr 2026 · Tags: CWE-494
- [Improper TLS Certificate Validation RCE via Malicious Update in DeskTime Time Tracking App](https://agentprime.io/advisories/CVE-2025-10539.md)
  `CVE-2025-10539` · CVE record: DeskTime DeskTime Time Tracking App · CVSS 4.8 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Weak cryptography or TLS, CWE-296, CWE-494
- [Anviz Products Download of Code Without Integrity Check](https://agentprime.io/advisories/CVE-2026-40066.md)
  `CVE-2026-40066` · CVE record: Anviz Anviz CX7 Firmware and 1 more · CVSS 8.8 High · Not analysed yet · Published 17 Apr 2026 · Tags: CWE-494
- [Download of code without integrity check in ASUS Member Center(华硕大厅)](https://agentprime.io/advisories/CVE-2026-3428.md)
  `CVE-2026-3428` · CVE record: ASUS Member Center(华硕大厅) · CVSS 5.4 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: Race condition, CWE-494
- [Axios npm Supply Chain Incident Impacting @usebruno/cli](https://agentprime.io/advisories/GHSA-658g-p7jg-wx5g.md)
  `GHSA-658g-p7jg-wx5g`, `CVE-2026-34841` · npm `@usebruno/cli`: affected `<3.2.1`, fixed in `3.2.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-494, CWE-506, CWE-1395
- [An issue in the firmware update mechanism of Qianniao QN-L23PA0904 v20250721.1640 allows attackers to gain root access, install backdoors, and exfiltrate data via supplying a crafted iu.sh script con…](https://agentprime.io/advisories/CVE-2026-30603.md)
  `CVE-2026-30603` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-345, CWE-494
- [TrueConf Client Update Integrity Verification Bypass](https://agentprime.io/advisories/CVE-2026-3502.md)
  `CVE-2026-3502` · CVE record: TrueConf TrueConf Client · CVSS 7.8 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 30 Mar 2026 · Tags: CWE-494
- [FastGPT has Arbitrary Code Execution in GitHub Actions via pull_request_target in fastgpt-preview-image.yml](https://agentprime.io/advisories/CVE-2026-33075.md)
  `CVE-2026-33075` · CVE record: labring FastGPT · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-494, CWE-829
- [ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack](https://agentprime.io/advisories/GHSA-hqmj-h5c6-369m.md)
  `GHSA-hqmj-h5c6-369m`, `CVE-2026-28500`, `PYSEC-2026-103` · PyPI `onnx`: affected `<1.21.0rc1`, fixed in `1.21.0rc1` · CVSS 8.6 High · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-345, CWE-494, CWE-693, CWE-829
- [Download of code without integrity check in ASUS Driver( Keyboard & Mouse ) and others](https://agentprime.io/advisories/CVE-2026-1878.md)
  `CVE-2026-1878` · CVE record: ASUS Driver( Keyboard & Mouse ) and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: CWE-494
- [Changing｜IDExpert Windows Logon Agent - Remote Code Execution](https://agentprime.io/advisories/CVE-2026-3000.md)
  `CVE-2026-3000` · CVE record: Changing IDExpert Windows Logon Agent · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-494
- [Changing｜IDExpert Windows Logon Agent - Remote Code Execution](https://agentprime.io/advisories/CVE-2026-2999.md)
  `CVE-2026-2999` · CVE record: Changing IDExpert Windows Logon Agent · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-494
- [Unsigned upgrade package](https://agentprime.io/advisories/CVE-2025-47904.md)
  `CVE-2025-47904` · CVE record: Microchip Time Provider 4100 · CVSS 5.7 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: CWE-494
- [MajorDoMo Supply Chain Remote Code Execution via Update URL Poisoning](https://agentprime.io/advisories/CVE-2026-27180.md)
  `CVE-2026-27180` · CVE record: sergejey MajorDoMo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Feb 2026 · Tags: CWE-494
- [Missing Firmware Authenticity Checks in Solax Power Pocket WiFi models](https://agentprime.io/advisories/CVE-2025-15575.md)
  `CVE-2025-15575` · CVE record: SolaX Power Pocket WiFi 3.0 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 12 Feb 2026 · Tags: CWE-494
- [SumatraPDF Update MITM -> Arbitrary Code Execution](https://agentprime.io/advisories/CVE-2026-25961.md)
  `CVE-2026-25961` · CVE record: sumatrapdfreader sumatrapdf · CVSS 7.5 High · Not analysed yet · Published 9 Feb 2026 · Tags: Weak cryptography or TLS, CWE-494
- [Cisco Secure Web Appliance TBD Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-20056.md)
  `CVE-2026-20056` · CVE record: Cisco Cisco Secure Web Appliance · CVSS 4.0 Medium · Not analysed yet · Published 4 Feb 2026 · Tags: CWE-494
- [Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification](https://agentprime.io/advisories/CVE-2025-15556.md)
  `CVE-2025-15556` · CVE record: notepad-plus-plus notepad-plus-plus · CVSS 7.7 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 3 Feb 2026 · Tags: CWE-494
- [Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts](https://agentprime.io/advisories/CVE-2026-22865.md)
  `CVE-2026-22865` · CVE record: gradle gradle · CVSS 8.6 High · Not analysed yet · Published 16 Jan 2026 · Tags: CWE-494, CWE-829
- [Gradle fails to disable repositories which can expose builds to malicious artifacts](https://agentprime.io/advisories/CVE-2026-22816.md)
  `CVE-2026-22816` · CVE record: gradle gradle · CVSS 8.6 High · Not analysed yet · Published 16 Jan 2026 · Tags: CWE-494, CWE-829
- [pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies](https://agentprime.io/advisories/GHSA-7vhp-vf5g-r2fw.md)
  `GHSA-7vhp-vf5g-r2fw`, `CVE-2025-69263` · npm `pnpm`: affected `<10.26.0`, fixed in `10.26.0` · CVSS 7.5 High · Not analysed yet · Published 7 Jan 2026 · Tags: CWE-494
- [ChurchCRM vulnerable to RCE with database restore functionality](https://agentprime.io/advisories/CVE-2025-68109.md)
  `CVE-2025-68109` · CVE record: ChurchCRM CRM · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Dec 2025 · Tags: Command injection, Unrestricted file upload, Information disclosure, Broken access control
- [The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard-coded WiFi credentials identical across all devices and does not authenticate u…](https://agentprime.io/advisories/CVE-2025-65855.md)
  `CVE-2025-65855` · CVE record · CVSS 6.6 Medium · Not analysed yet · Published 17 Dec 2025 · Tags: Weak cryptography or TLS, Hard-coded credentials, CWE-494
- [Improper server-side validation in ScreenConnect extension framework](https://agentprime.io/advisories/CVE-2025-14265.md)
  `CVE-2025-14265` · CVE record: ConnectWise ScreenConnect · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Dec 2025 · Tags: CWE-494
- [An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2.](https://agentprime.io/advisories/CVE-2025-55310.md)
  `CVE-2025-55310` · CVE record · CVSS 7.3 High · Not analysed yet · Published 11 Dec 2025 · Tags: CWE-494
- [Download of code without integrity check in Huawei HarmonyOS](https://agentprime.io/advisories/CVE-2025-66334.md)
  `CVE-2025-66334` · CVE record: Huawei HarmonyOS · CVSS 3.3 Low · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-494
- [Download of code without integrity check in Huawei HarmonyOS](https://agentprime.io/advisories/CVE-2025-66333.md)
  `CVE-2025-66333` · CVE record: Huawei HarmonyOS · CVSS 3.3 Low · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-494
- [Download of code without integrity check in Huawei HarmonyOS](https://agentprime.io/advisories/CVE-2025-66332.md)
  `CVE-2025-66332` · CVE record: Huawei HarmonyOS · CVSS 3.3 Low · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-494
- [Download of code without integrity check in Huawei HarmonyOS](https://agentprime.io/advisories/CVE-2025-66331.md)
  `CVE-2025-66331` · CVE record: Huawei HarmonyOS · CVSS 3.3 Low · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-494
- [An issue in Shirt Pocket SuperDuper!](https://agentprime.io/advisories/CVE-2025-61228.md)
  `CVE-2025-61228` · CVE record · CVSS 7.8 High · Not analysed yet · Published 1 Dec 2025 · Tags: CWE-494
- [The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure.](https://agentprime.io/advisories/CVE-2025-63434.md)
  `CVE-2025-63434` · CVE record · CVSS 8.8 High · Not analysed yet · Published 24 Nov 2025 · Tags: CWE-494
- [Download of code without integrity check in SonicWall Email Security](https://agentprime.io/advisories/CVE-2025-40604.md)
  `CVE-2025-40604` · CVE record: SonicWall Email Security · CVSS 6.5 Medium · Not analysed yet · Published 20 Nov 2025 · Tags: CWE-494
- [The Sound4 FIRST web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package.](https://agentprime.io/advisories/CVE-2025-63220.md)
  `CVE-2025-63220` · CVE record · CVSS 7.2 High · Not analysed yet · Published 19 Nov 2025 · Tags: CWE-494
- [The Sound4 IMPACT web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package.](https://agentprime.io/advisories/CVE-2025-63215.md)
  `CVE-2025-63215` · CVE record · CVSS 7.2 High · Not analysed yet · Published 18 Nov 2025 · Tags: CWE-494
- [An issue in the Web Configuration module of Startcharge Artemis AC Charger 7-22 kW v1.0.4 allows authenticated network-adjacent attackers to upload crafted firmware, leading to arbitrary code executi…](https://agentprime.io/advisories/CVE-2025-52263.md)
  `CVE-2025-52263` · CVE record · CVSS 8.0 High · Not analysed yet · Published 27 Oct 2025 · Tags: CWE-494
- [Self-Update Verification Mechanism Process in ConnectWise Automate](https://agentprime.io/advisories/CVE-2025-11493.md)
  `CVE-2025-11493` · CVE record: ConnectWise Automate · CVSS 8.8 High · Not analysed yet · Published 16 Oct 2025 · Tags: CWE-494
- [File Download in GTONE ChangeFlow](https://agentprime.io/advisories/CVE-2025-11182.md)
  `CVE-2025-11182` · CVE record: GTONE ChangeFlow · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2025 · Tags: Path traversal, CWE-494
- [NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks.](https://agentprime.io/advisories/CVE-2025-56513.md)
  `CVE-2025-56513` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2025 · Tags: CWE-494
- [Vasion Print (formerly PrinterLogic) Insecure Build Pipeline](https://agentprime.io/advisories/CVE-2025-34212.md)
  `CVE-2025-34212` · CVE record: Vasion Print Virtual Appliance Host and 1 more · CVSS 8.7 High · Not analysed yet · Published 29 Sept 2025 · Tags: Broken access control, CWE-494
- [The Sound4 PULSE-ECO AES67 1.22 web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package.](https://agentprime.io/advisories/CVE-2025-57431.md)
  `CVE-2025-57431` · CVE record · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2025 · Tags: CWE-494
- [Download of code without integrity check in Lenovo Wallpaper Client](https://agentprime.io/advisories/CVE-2025-9319.md)
  `CVE-2025-9319` · CVE record: Lenovo Wallpaper Client · CVSS 7.5 High · Not analysed yet · Published 11 Sept 2025 · Tags: CWE-494
- [ECOVACS Vacuum and Base Station accept unsigned firmware](https://agentprime.io/advisories/CVE-2025-30199.md)
  `CVE-2025-30199` · CVE record: ECOVACS DEEBOT X1 Series and 3 more · CVSS 7.5 High · Not analysed yet · Published 5 Sept 2025 · Tags: CWE-494
- [D-Link DCS-825L firmware v1.08.01 contains a vulnerability in the watchdog script \`mydlink-watch-dog.sh\`, which blindly respawns binaries such as \`dcp\` and \`signalc\` without verifying integrity, auth…](https://agentprime.io/advisories/CVE-2025-55582.md)
  `CVE-2025-55582` · CVE record · CVSS 6.6 Medium · Not analysed yet · Published 27 Aug 2025 · Tags: Privilege escalation, CWE-494
- [Agiloft insecure download of system packages](https://agentprime.io/advisories/CVE-2025-35115.md)
  `CVE-2025-35115` · CVE record: Agiloft Agiloft · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2025 · Tags: CWE-494
- [An issue was discovered in Mahara 23.04.8 and 24.04.4.](https://agentprime.io/advisories/CVE-2024-47192.md)
  `CVE-2024-47192` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 26 Aug 2025 · Tags: CWE-494
- [D-Link DCS-825L firmware version 1.08.01 and possibly prior versions contain an insecure implementation in the mydlink-watch-dog.sh script.](https://agentprime.io/advisories/CVE-2025-55581.md)
  `CVE-2025-55581` · CVE record · CVSS 7.3 High · Not analysed yet · Published 22 Aug 2025 · Tags: Privilege escalation, Authentication bypass, CWE-494
- [Download of code without integrity check in Tenda AC6 V5.0](https://agentprime.io/advisories/CVE-2025-31355.md)
  `CVE-2025-31355` · CVE record: Tenda AC6 V5.0 · CVSS 7.2 High · Not analysed yet · Published 20 Aug 2025 · Tags: CWE-494
- [EG4 Electronics EG4 Inverters Download of Code Without Integrity Check](https://agentprime.io/advisories/CVE-2025-53520.md)
  `CVE-2025-53520` · CVE record: EG4 Electronics EG4 12kPV and 4 more · CVSS 8.6 High · Not analysed yet · Published 8 Aug 2025 · Tags: CWE-494
- [Download of code without integrity check in Johnson Controls, Inc iSTAR Ultra](https://agentprime.io/advisories/CVE-2025-53696.md)
  `CVE-2025-53696` · CVE record: Johnson Controls, Inc iSTAR Ultra · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jul 2025 · Tags: CWE-494
- [DSIC｜Cross-browser Components for Official Document Creation - Remote Code Execution](https://agentprime.io/advisories/CVE-2025-7620.md)
  `CVE-2025-7620` · CVE record: DSIC Cross-browser Components for Official Document Creation · CVSS 8.6 High · Not analysed yet · Published 14 Jul 2025 · Tags: CWE-494
- [Vulnerability in PointCloudLibrary PCL](https://agentprime.io/advisories/CVE-2025-52937.md)
  `CVE-2025-52937` · CVE record: PointCloudLibrary pcl · CVSS 2.0 Low · Not analysed yet · Published 23 Jun 2025 · Tags: CWE-494
- [Nautel VX Series transmitters VX SW v6.4.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the firmware update process.](https://agentprime.io/advisories/CVE-2025-28236.md)
  `CVE-2025-28236` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Apr 2025 · Tags: CWE-494
- [RCE due to Device Driver](https://agentprime.io/advisories/CVE-2025-27593.md)
  `CVE-2025-27593` · CVE record: SICK AG SICK DL100-2xxxxxxx · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Mar 2025 · Tags: CWE-494
- [IBM Engineering Requirements Management DOORS Next file download](https://agentprime.io/advisories/CVE-2024-43169.md)
  `CVE-2024-43169` · CVE record: IBM Engineering Requirements Management DOORS Next · CVSS 8.8 High · Not analysed yet · Published 3 Mar 2025 · Tags: CWE-494
- [SunGrow WiNet-S V200.001.00.P025 and earlier versions is missing integrity checks for firmware upgrades.](https://agentprime.io/advisories/CVE-2024-50696.md)
  `CVE-2024-50696` · CVE record · CVSS 7.5 High · Not analysed yet · Published 26 Feb 2025 · Tags: CWE-494
- [Download of code without integrity check in Schneider Electric ASCO 5310 Single-Channel Remote Annunciator and others](https://agentprime.io/advisories/CVE-2025-1058.md)
  `CVE-2025-1058` · CVE record: Schneider Electric ASCO 5310 Single-Channel Remote Annunciator and 1 more · CVSS 7.2 High · Not analysed yet · Published 13 Feb 2025 · Tags: CWE-494
- [ECOVACS lawnmowers and vacuums deterministic firmware encryption key](https://agentprime.io/advisories/CVE-2024-52331.md)
  `CVE-2024-52331` · CVE record: ECOVACS Unspecified robots · CVSS 7.7 High · Not analysed yet · Published 23 Jan 2025 · Tags: Weak cryptography or TLS, Hard-coded credentials, CWE-494
- [HCL BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability](https://agentprime.io/advisories/CVE-2024-42183.md)
  `CVE-2024-42183` · CVE record: HCL Software BigFix Patch Management Download Plug-ins · CVSS 2.5 Low · Not analysed yet · Published 23 Jan 2025 · Tags: CWE-494

Newest: <https://agentprime.io/advisories/tag/cwe-494.md>
Older: <https://agentprime.io/advisories/tag/cwe-494.md?cursor=WyIyMDI1LTAxLTIzVDAxOjQyOjQ3LjQ5NjAwMFoiLCJDVkUtMjAyNC00MjE4MyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-494&cursor=WyIyMDI2LTA1LTA0VDIxOjI3OjE3LjAwMDAwMFoiLCJHSFNBLWhjd3ItcHE5Zy1ycTNtIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-494/?cursor=WyIyMDI2LTA1LTA0VDIxOjI3OjE3LjAwMDAwMFoiLCJHSFNBLWhjd3ItcHE5Zy1ycTNtIl0>. Everything for agents: <https://agentprime.io/llms.txt>.