CWE-494: Download of Code Without Integrity Check
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
A kind of CWE-345 Insufficient Verification of Data Authenticity.
From the CWE List. © The MITRE Corporation.
Newest
- go-vikunja vikunja Vikunja before 2.7.1 Supply Chain Risk via Unpinned xgo Release Toolchain 2.0 Low
- progress software fiddler download & setup skill Missing Integrity Verification in Progress Software Fiddler Download & Setup Skill 7.5 High
- nvm-sh nvm nvm install --offline installs a cached tarball that previously failed checksum verification 2.1 Low
- phoenix contact plcnext engineer Signed plug-in validation bypass 8.6 High
- red hat openshift container platform 4, openshift container platform 5 +1 more Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification 7.4 High
- apple container, containerization +1 more An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one… 5.6 Medium
- creative labs sound blaster katana v2, v2x, se Firmware verification vulnerability 9.6 Critical
- pypa virtualenv virtualenv: Pip seeding with download omits wheel digest verification 2.3 Low
- energizelab ai station firmware (rk3562), robot firmware (mode 104000), windows desktop app (energizelabsetup-3.1.2-win.exe) +2 more EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks 7.5 High
- eclipse foundation adoptium temurin In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 ... 7.5 High
- anthropics claude-code Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning 7.5 High
- romkatv powerlevel10k powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer 7.7 High
- iflytek astron-rpa AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed 7.7 High
- nginxui nginx ui, 0xjacky nginx-ui +1 more Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM 7.5 High
- red lion controls 700 series Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Check 8.4 High
- mitel mivoice office 400 Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution 8.4 High
- mitel mivoice office 400 Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Execution 8.5 High
- gitahead GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass 7.7 High
- No product listed Laradock Build Process Dockerfile code download 2.3 Low
- netbox-community devicetype-library NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files 6.5 Medium
- jetbrains rider In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user... 4.8 Medium
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 more Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to... 4.7 Medium
- pollen robotics reachy mini Reachy Mini daemon allows unauthenticated remote code execution through the app installation endpoint 8.8 High
- laurent22 joplin Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName 7.1 High
- spatie scotty spatie Scotty Self Update SelfUpdater.php update code download 5.3 Medium
- sublime hq pty ltd text 3, text 4 +1 more Sublime Text 4192/3207 Local Privilege Escalation via Update Staging Mechanism 7.0 High
- pypa virtualenv virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use 7.7 High
- jenkins script security, jenkins project script security plugin +1 more Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified... 7.5 High
- dell smartfabric os10 software Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download of Code Without... 9.1 Critical
- dell thinos, thinos 10 +1 more Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of Code Without Integrity... 6.8 Medium
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 more Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior... 7.4 High
- siemens reyrolle 7sr5 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special... 7.0 High
- themoos essential-moos MOOS essential-moos through 10.0.1 pAntler Remote Code Execution via Unauthenticated MISSION_FILE 9.2 Critical
- jenkins project job configuration history plugin Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the... 5.4 Medium
- jenkins project gitlab plugin Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection... 5.4 Medium
- hugging face transformers Hugging Face Transformers library writes remote code to disk prior to consent check 7.8 High
- nousresearch hermes-agent Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference 9.0 Critical
- No product listed An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and... 9.8 Critical
- hclsoftware bigfix quantum risk analyzer HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and downloading code without integrity checking 4.4 Medium
- nvidia nemoclaw NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker... 8.1 High
- nvidia nemoclaw NVIDIA NemoClaw for Linux contains a vulnerability in its installation scripts, where an attacker... 7.5 High
- watchguard agent WatchGuard Agent improper authentication allows unauthenticated remote code execution 9.3 Critical
- ozols grupa ozols Critical flaw impacting OZOLS ERP's automatic update channel 10.0 Critical
- dep0we atomic-agents-stack atomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCP 9.2 Critical
- lucasgelfond zerobrew ZeroBrew version 0.3.1 and prior Missing Checksum Verification RCE via shim.rb 7.5 High
- spring for graphql, vmware spring for graphql +1 more Spring for GraphQL loads Untrusted Resources in GraphiQL support 8.1 High
- ibm i access client solutions IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities 8.3 High
- truelockmc streambert Streambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC Handler 9.3 Critical
- latvijas valsts radio un televīzijas centrs (lvrtc) eparakstītājs 3.0 eParakstītājs 3.0 for Windows – remote code execution via unauthenticated auto-update 7.3 High
- nltk, nltk nltk/nltk +1 more Improper Input Validation in nltk/nltk 5.3 Medium
- Show olderLoading…