Joplin Desktop for Windows versions prior to 3.7.2 have a vulnerability where the update mechanism does not properly verify the authenticity of update packages. This allows an attacker controlling the update delivery path to replace update metadata and installers with malicious versions that may be unsigned or signed by an unauthorized publisher. Exploitation can lead to execution of attacker-controlled code with the user's privileges, risking compromise of notes, credentials, and local data. The issue is fixed in version 3.7.2.
A vulnerability was identified in spatie Scotty up to 1.4.2. Affected is the function SelfUpdater::update of the file app/Updater/SelfUpdater.php of the component Self Update Handler. Such manipulation leads to download of code without integrity check. It is possible to launch the attack remotely. Upgrading to version 1.4.3 is able to address this issue. The name of the patch is 4b4e11bfc98e3a2159bb2b3d9b040293fcc44744. It is advisable to upgrade the affected component.
Dell SmartFabric OS10 Software versions prior to 10.6.1.3 have a vulnerability where code is downloaded without an integrity check. This flaw could allow a high privileged remote attacker to execute arbitrary code. The vulnerability is identified as CWE-494 and has a critical severity rating with a CVSS score of 9.1.
Dell ThinOS 10 versions prior to 2605_10.2616 have a vulnerability where code can be downloaded without an integrity check. This flaw allows an unauthenticated attacker with physical access to potentially execute arbitrary code on the device.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command execution.
A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance mode can be activated via a physical key sequence during device boot, in which the device downloads and executes program code from a network server without verifying its authenticity or integrity. This could allow an attacker with physical access to the device to upload and execute arbitrary, unsigned code.
A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths (such as AutoConfig, AutoModel, and AutoTokenizer). As a result, attacker‑controlled Python code from custom_generate/generate.py is copied into the user’s ~/.cache/huggingface/modules directory even if the user declines the trust prompt. Although execution is correctly gated, the file write is not reversible and can persist across sessions. This can lead to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads. The issue stems from an unconditional file write in dynamic_module_utils.py prior to any trust verification.
The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page.
Spring for GraphQL 2.0.0 - 2.0.4
Spring for GraphQL 1.4.0 - 1.4.6
Spring for GraphQL 1.1.0 - 1.3.9
Spring for GraphQL 1.0.0 - 1.0.7
CVE-2026-21810 affects HCL BigFix Quantum Risk Analyzer version 2.0.1.47 and involves a hardcoded external resource reference combined with a lack of binary integrity checks. This vulnerability could allow an attacker with high privileges to modify the binary, potentially leading to unauthorized code changes. The CVSS score is 4.4, indicating a medium severity level. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
NVIDIA NemoClaw for Linux has a vulnerability in its installation process that allows execution of untrusted code. Exploiting this flaw could lead to code execution, privilege escalation, data tampering, information disclosure, and denial of service. The vulnerability is identified as CWE-494, involving download of code without integrity checks. No patch or official remediation has been announced yet.
NVIDIA NemoClaw for Linux has a vulnerability in its installation scripts that allows downloading code without verifying its integrity. Exploiting this flaw could enable attackers to execute arbitrary code, escalate privileges, disclose information, and tamper with data. The vulnerability is identified as CWE-494 and has a CVSS 3.1 score of 7.5, indicating high severity. No specific affected versions or patches are currently documented.
Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges.
CVE-2026-22306 is a critical vulnerability in Ozols Grupa's OZOLS product prior to version 1.1.1233. It involves the download of code without integrity checks, inclusion of functionality from an untrusted control sphere, and cleartext transmission of sensitive information. The issue stems from an abandoned auto-update domain affecting the automatic update channel, specifically the OzolsSQL client update path, a SQL Server Agent job, and a VBScript file. This vulnerability allows remote attackers to potentially execute arbitrary code without user interaction and without requiring privileges.
IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's workstation.
Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability that allows a compromised renderer process to make the main process download and execute an arbitrary binary, resulting in remote code execution. Version 2.5.0 contains a patch.
eParakstītājs 3.0 for Windows before version
1.10.0 retrieves and executes its automatic updates over a channel that is not
authenticated or integrity-protected. On each launch the application fetches an
update descriptor (XML) over TLS but accepts any TLS certificate (a permissive
TrustManager and a HostnameVerifier that always returns true), does not verify
any digital signature on the update descriptor, and does not verify the
Authenticode signature or a checksum of the downloaded installer before running
it. A man-in-the-middle attacker able to redirect www.eparaksts.lv can serve a
crafted update descriptor pointing to an attacker-controlled executable, which
the client downloads and executes, resulting in arbitrary code execution on the
victim host.
CVE-2026-12259 is a medium severity vulnerability in nltk version 3.9.4 where the downloader component may write and extract package data before verifying integrity checks such as SHA-256 or MD5. This flaw allows an attacker who can manipulate the package source (e.g., via a compromised mirror or malicious proxy) to substitute malicious package content. As a result, downstream users or applications may trust and use attacker-controlled corpus or model data.
FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, artifacts built from untrusted pull request code in .github/workflows/preview-docs-build.yml and .github/workflows/preview-fastgpt-build.yml can be downloaded by privileged workflow_run jobs in .github/workflows/preview-docs-push.yml and .github/workflows/preview-fastgpt-push.yml, allowing attacker-controlled Docker images from the document/ tree or FastGPT build context to be pushed to GHCR and, for documentation previews, deployed with secrets.KUBE_CONFIG_CN.
CVE-2026-9037 is a critical vulnerability in the XCharge C6 charging controller where the firmware update mechanism does not verify the authenticity of firmware packages. This lack of cryptographic signature validation allows an attacker who can intercept or impersonate the management interface to install unauthorized firmware. Exploitation could lead to execution of unauthorized code with high privileges on the device. No official patch or remediation guidance has been provided yet, and no known exploits are reported in the wild.
CVE-2026-9089 is a high-severity vulnerability in ConnectWise Automate Agent prior to version 2026.5. The agent does not fully verify the authenticity of components downloaded during plugin loading and self-update processes, which could allow an attacker to execute malicious code. This issue is addressed in Automate version 2026.5. The vulnerability has a CVSS score of 8.8, indicating a significant risk of confidentiality, integrity, and availability impact. No known exploits are reported in the wild at this time.