CWE-494.

Lockfile checksums not verified in Hex allows dependency integrity bypass

• hex
• CWE-354
• CWE-494

Remote Code Execution in Ollama via Update Mechanism

• Ollama
• Path traversal
• CWE-494

Missing Signature Verification for Updates in Ollama

• Ollama
• CWE-494

Improper TLS Certificate Validation RCE via Malicious Update in DeskTime Time Tracking App

• DeskTime Time Tracking App
• Weak cryptography or TLS
• CWE-296

Anviz Products Download of Code Without Integrity Check

• Anviz CX7 Firmware
• Anviz CX2 Lite Firmware
• CWE-494

Download of code without integrity check in ASUS Member Center(华硕大厅)

• ASUS Member Center(华硕大厅)
• Race condition
• CWE-494

Axios npm Supply Chain Incident Impacting @usebruno/cli

• CWE-494
• CWE-506

<3.2.1 · fixed in 3.2.1

An issue in the firmware update mechanism of Qianniao QN-L23PA0904 v20250721.1640 allows attackers to gain root access, install backdoors, and exfiltrate data via supplying a crafted iu.sh script con…

• CWE-345
• CWE-494

TrueConf Client Update Integrity Verification Bypass

• TrueConf Client
• CWE-494

FastGPT has Arbitrary Code Execution in GitHub Actions via pull_request_target in fastgpt-preview-image.yml

• labring FastGPT
• CWE-494
• CWE-829

ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack

• CWE-345
• CWE-494

<1.21.0rc1 · fixed in 1.21.0rc1

Download of code without integrity check in ASUS Driver( Keyboard & Mouse ) and others

• ASUS Driver( Keyboard & Mouse )
• ASUS Driver( Headset )
• CWE-494

Changing｜IDExpert Windows Logon Agent - Remote Code Execution

• Changing IDExpert Windows Logon Agent
• CWE-494

Changing｜IDExpert Windows Logon Agent - Remote Code Execution

• Changing IDExpert Windows Logon Agent
• CWE-494

Unsigned upgrade package

• Microchip Time Provider 4100
• CWE-494

MajorDoMo Supply Chain Remote Code Execution via Update URL Poisoning

• sergejey MajorDoMo
• CWE-494

Missing Firmware Authenticity Checks in Solax Power Pocket WiFi models

• SolaX Power Pocket WiFi 3.0
• SolaX Power Pocket WiFi+LAN
• CWE-494

SumatraPDF Update MITM -> Arbitrary Code Execution

• sumatrapdf
• Weak cryptography or TLS
• CWE-494

Cisco Secure Web Appliance TBD Bypass Vulnerability

• Cisco Secure Web Appliance
• CWE-494

Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification

• notepad-plus-plus
• CWE-494

Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts

• gradle
• CWE-494
• CWE-829

Gradle fails to disable repositories which can expose builds to malicious artifacts

• gradle
• CWE-494
• CWE-829

pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies

• CWE-494

<10.26.0 · fixed in 10.26.0

ChurchCRM vulnerable to RCE with database restore functionality

• CRM
• Command injection
• Unrestricted file upload

The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard-coded WiFi credentials identical across all devices and does not authenticate u…

• Weak cryptography or TLS
• Hard-coded credentials

Improper server-side validation in ScreenConnect extension framework

• ConnectWise ScreenConnect
• CWE-494

An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2.

• CWE-494

Download of code without integrity check in Huawei HarmonyOS

• Huawei HarmonyOS
• CWE-494

Download of code without integrity check in Huawei HarmonyOS

• Huawei HarmonyOS
• CWE-494

Download of code without integrity check in Huawei HarmonyOS

• Huawei HarmonyOS
• CWE-494

Download of code without integrity check in Huawei HarmonyOS

• Huawei HarmonyOS
• CWE-494

An issue in Shirt Pocket SuperDuper!

• CWE-494

The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure.

• CWE-494

Download of code without integrity check in SonicWall Email Security

• SonicWall Email Security
• CWE-494

The Sound4 FIRST web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package.

• CWE-494

The Sound4 IMPACT web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package.

• CWE-494

An issue in the Web Configuration module of Startcharge Artemis AC Charger 7-22 kW v1.0.4 allows authenticated network-adjacent attackers to upload crafted firmware, leading to arbitrary code executi…

• CWE-494

Self-Update Verification Mechanism Process in ConnectWise Automate

• ConnectWise Automate
• CWE-494

File Download in GTONE ChangeFlow

• GTONE ChangeFlow
• Path traversal
• CWE-494

NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks.

• CWE-494

Vasion Print (formerly PrinterLogic) Insecure Build Pipeline

• Vasion Print Virtual Appliance Host
• Vasion Print Application
• Broken access control
• CWE-494

The Sound4 PULSE-ECO AES67 1.22 web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package.

• CWE-494

Download of code without integrity check in Lenovo Wallpaper Client

• Lenovo Wallpaper Client
• CWE-494

ECOVACS Vacuum and Base Station accept unsigned firmware

• ECOVACS DEEBOT X1 Series
• ECOVACS DEEBOT T20 Series
• CWE-494

D-Link DCS-825L firmware v1.08.01 contains a vulnerability in the watchdog script `mydlink-watch-dog.sh`, which blindly respawns binaries such as `dcp` and `signalc` without verifying integrity, auth…

• Privilege escalation
• CWE-494

Agiloft insecure download of system packages

• Agiloft
• CWE-494

An issue was discovered in Mahara 23.04.8 and 24.04.4.

• CWE-494

D-Link DCS-825L firmware version 1.08.01 and possibly prior versions contain an insecure implementation in the mydlink-watch-dog.sh script.

• Privilege escalation
• Authentication bypass

Download of code without integrity check in Tenda AC6 V5.0

• Tenda AC6 V5.0
• CWE-494

EG4 Electronics EG4 Inverters Download of Code Without Integrity Check

• EG4 Electronics EG4 12kPV
• EG4 Electronics EG4 18kPV
• CWE-494

Download of code without integrity check in Johnson Controls, Inc iSTAR Ultra

• Johnson Controls, Inc iSTAR Ultra
• CWE-494

DSIC｜Cross-browser Components for Official Document Creation - Remote Code Execution

• DSIC Cross-browser Components for Official Document Creation
• CWE-494

Vulnerability in PointCloudLibrary PCL

• PointCloudLibrary pcl
• CWE-494

Nautel VX Series transmitters VX SW v6.4.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the firmware update process.

• CWE-494

RCE due to Device Driver

• SICK AG SICK DL100-2xxxxxxx
• CWE-494

IBM Engineering Requirements Management DOORS Next file download

• IBM Engineering Requirements Management DOORS Next
• CWE-494

SunGrow WiNet-S V200.001.00.P025 and earlier versions is missing integrity checks for firmware upgrades.

• CWE-494

Download of code without integrity check in Schneider Electric ASCO 5310 Single-Channel Remote Annunciator and others

• Schneider Electric ASCO 5310 Single-Channel Remote Annunciator
• Schneider Electric ASCO 5350 Eight Channel Remote Annunciator
• CWE-494

ECOVACS lawnmowers and vacuums deterministic firmware encryption key

• ECOVACS Unspecified robots
• Weak cryptography or TLS
• Hard-coded credentials

HCL BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability

• HCL Software BigFix Patch Management Download Plug-ins
• CWE-494