CWE-494.

nvm install --offline installs a cached tarball that previously failed checksum verification

• nvm
• CWE-459
• CWE-494

Signed plug-in validation bypass

• Phoenix Contact PLCnext Engineer
• CWE-494

Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification

• Red Hat OpenShift Container Platform 4
• Red Hat OpenShift Container Platform 5
• CWE-494

Download of code without integrity check in Apple container and others

• Apple container
• Apple containerization
• CWE-494

virtualenv: Pip seeding with download omits wheel digest verification

• CWE-494

<21.14.9 · fixed in 21.14.9

Firmware verification vulnerability

• Creative Labs Creative Sound Blaster Katana V2, V2X, SE
• CWE-494

EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks

• EnergizeLab Robot firmware (mode 104000)
• EnergizeLab AI Station firmware (RK3562)
• CWE-494

Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

• CWE-494
• CWE-829

<2.1.179 · fixed in 2.1.179

Download of code without integrity check in Eclipse Foundation Adoptium Temurin

• Eclipse Foundation Adoptium Temurin
• Open redirect
• CWE-494

powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer

• romkatv powerlevel10k
• CWE-494

Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM

• CWE-494

>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728114330-580585516dd8 · fixed in 1.9.10-0.20260728114330-580585516dd8

AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed

• iflytek astron-rpa
• CWE-494

Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Check

• Red Lion Controls 700 Series
• CWE-494

Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution

• Mitel MiVoice Office 400
• Path traversal
• CWE-426

Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Execution

• Mitel MiVoice Office 400
• Path traversal
• Unrestricted file upload

GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass

• GitAhead
• CWE-494

Laradock Build Process Dockerfile code download

• Laradock
• CWE-494

NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files

• netbox-community devicetype-library
• Code injection
• CWE-494

virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

• CWE-494

<21.7.12 · fixed in 21.7.12

Download of code without integrity check in JetBrains Rider

• JetBrains Rider
• CWE-494

Download of code without integrity check in Dell Secure Connect Gateway (SCG) Policy Manager

• Dell Secure Connect Gateway (SCG) Policy Manager
• CWE-494

Reachy Mini daemon allows unauthenticated remote code execution through the app installation endpoint

• Pollen Robotics Reachy Mini
• Authentication bypass
• CWE-494

Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName

• laurent22 joplin
• CWE-345
• CWE-353

spatie Scotty Self Update SelfUpdater.php update code download

• spatie Scotty
• CWE-494

Sublime Text 4192/3207 Local Privilege Escalation via Update Staging Mechanism

• Sublime HQ Pty Ltd Sublime Text 4
• Sublime HQ Pty Ltd Sublime Text 3
• CWE-494

Download of code without integrity check in Jenkins Project Jenkins Script Security Plugin

• Jenkins Project Jenkins Script Security Plugin
• CWE-494

Download of code without integrity check in Dell SmartFabric OS10 Software

• Dell SmartFabric OS10 Software
• CWE-494

Download of code without integrity check in Dell ThinOS 10

• Dell ThinOS 10
• CWE-494

Download of code without integrity check in Dell Secure Connect Gateway 5.0 - Application and others

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• CWE-494

NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

• CWE-494

<3.9.3 · fixed in 3.9.3

Download of code without integrity check in Siemens Reyrolle 7SR5

• Siemens Reyrolle 7SR5
• CWE-494

MOOS essential-moos through 10.0.1 pAntler Remote Code Execution via Unauthenticated MISSION_FILE

• themoos essential-moos
• CWE-494

Improper input validation in Jenkins Project Jenkins Job Configuration History Plugin

• Jenkins Project Jenkins Job Configuration History Plugin
• CWE-20
• CWE-494

Download of code without integrity check in Jenkins Project Jenkins GitLab Plugin

• Jenkins Project Jenkins GitLab Plugin
• CWE-471
• CWE-494

Hugging Face Transformers downloads custom generation code before trust consent

• Race condition
• CWE-273

>=4.49.0, <=5.8.1 · no fixed version yet

Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference

• NousResearch hermes-agent
• CWE-494

Spring for GraphQL loads Untrusted Resources in GraphiQL support

• Spring for GraphQL
• CWE-494

An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.e…

• CWE-494

HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and downloading code without integrity checking

• HCLSoftware BigFix Quantum Risk Analyzer
• CWE-494
• CWE-610

Download of code without integrity check in NVIDIA NemoClaw

• NVIDIA NemoClaw
• CWE-494

Download of code without integrity check in NVIDIA NemoClaw

• NVIDIA NemoClaw
• CWE-494

WatchGuard Agent improper authentication allows unauthenticated remote code execution

• WatchGuard Agent
• Authentication bypass
• Weak cryptography or TLS

Critical flaw impacting OZOLS ERP's automatic update channel

• OZOLS
• Weak cryptography or TLS
• CWE-494

atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)

• Weak cryptography or TLS
• CWE-494

<1.1.0 · fixed in 1.1.0

ZeroBrew version 0.3.1 and prior Missing Checksum Verification RCE via shim.rb

• lucasgelfond ZeroBrew
• CWE-494

IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

• IBM i Access Client Solutions
• CWE-494

Streambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC Handler

• truelockmc streambert
• CWE-494

eParakstītājs 3.0 for Windows – remote code execution via unauthenticated auto-update

• Latvijas Valsts radio un televīzijas centrs (LVRTC) eParakstītājs 3.0
• Weak cryptography or TLS
• CWE-494

Duplicate Advisory: NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

• CWE-494

<=3.9.2 · no fixed version yet

phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API

• thorsten phpMyFAQ
• CWE-494

FastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflows

• labring FastGPT
• Privilege escalation
• CWE-494

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

• CWE-345
• CWE-494

<10.34.2 || >=11.0.0, <11.5.3 · fixed in 10.34.2, 11.5.3

pnpm: Repository-controlled configDependencies can select a pacquet native install engine

• Command injection
• CWE-494

<10.34.2 || >=11.0.0, <11.5.3 · fixed in 10.34.2, 11.5.3

Angular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension

• angular
• Cross-site scripting (XSS)
• Code injection

Withdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY

• CWE-426
• CWE-494

>=0.17.0, <0.28.1 · fixed in 0.28.1

stigmem-node's unsigned plugin override could be enabled without a second explicit acknowledgment

• CWE-494

<0.9.0a2 · fixed in 0.9.0a2

Download of code without integrity check in XCharge C6

• XCharge C6
• CWE-494

Download of code without integrity check in ConnectWise Automate

• ConnectWise Automate
• CWE-494

Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark

• Code injection
• Broken access control

<=3.8.8 · no fixed version yet

apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

• CWE-345
• CWE-494

<1.2.7 · fixed in 1.2.7