apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and available via ChecksumString(), and the downloaded package control hash is computed, but the two values are never compared in getPackageImpl(). Mismatched packages are silently accepted. An attacker who can substitute download responses (compromised mirror, HTTP repository, poisoned CDN cache) can install arbitrary packages into built images. This issue has been patched in version 1.2.7.
CVE-2026-32148 is a high-severity vulnerability in hexpm hex affecting versions from 0.16.0 before 2.4.2. It involves improper validation of dependency integrity checks due to a type mismatch in the verification logic, causing checksum verification to be skipped silently. This allows an attacker who can influence cached packages or a compromised registry to inject modified dependencies without detection. The mix.lock file is overwritten with attacker-controlled checksum values, erasing evidence of tampering. No official patch or remediation guidance is currently confirmed.
CVE-2025-10539 is a vulnerability in the DeskTime Time Tracking App prior to version 1.3.674 caused by improper TLS certificate validation. An attacker positioned in the network path between the client and update servers can deliver a malicious executable during an update request, resulting in user-level remote code execution. The vulnerability has a medium severity with a CVSS score of 4.8. No official patch or remediation guidance is currently confirmed. There are no known exploits in the wild at this time.
Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and executes a script resulting in unauthenticated remote code execution.
A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member Center(华硕大厅) allows a local user to achieve privilege escalation to Administrator via exploitation of a Time-of-check Time-of-use (TOC-TOU) during the update process, where an unexpected payload is substituted for a legitimate one immediately after download, and subsequently executed with administrative privileges upon user consent.
Refer to the 'Security Update for ASUS Member Center' section on the ASUS Security Advisory for more information.
Bruno, an open source IDE for API testing, was affected by a supply chain attack prior to version 3.2.1. The attack involved compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT). Users of @usebruno/cli who ran npm install between 00:21 UTC and approximately 03:30 UTC on March 31, 2026, may have been impacted. The vulnerability is addressed by upgrading to version 3.2.1.
TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.
FastGPT is an AI Agent building platform. In versions 4.14.8.3 and below, the fastgpt-preview-image.yml workflow is vulnerable to arbitrary code execution and secret exfiltration by any external contributor. It uses pull_request_target (which runs with access to repository secrets) but checks out code from the pull request author's fork, then builds and pushes Docker images using attacker-controlled Dockerfiles. This also enables a supply chain attack via the production container registry. A patch was not available at the time of publication.
An Insufficient Integrity Verification vulnerability in the ASUS ROG peripheral driver installation process allows privilege escalation to SYSTEM. The vulnerability is due to improper access control on the installation directory, which enables the exploitation of a race condition where the legitimate installer is substituted with an unexpected payload immediately after download, resulting in arbitrary code execution. Refer to the "Security Update for ASUS ROG peripheral driver" section on the ASUS Security Advisory for more information.
IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary DLL files from a remote source and execute them.
IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and execute them.
Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.
The firmware update functionality does not verify the authenticity of the supplied firmware update files. This allows attackers to flash malicious firmware update files on the device. Initial analysis of the firmware update functionality does not show any cryptographic checks (e.g.digital signature checks) on the supplied firmware update files. Furthermore, ESP32 security features such as secure boot are not used.
CVE-2026-25961 is a high-severity vulnerability in SumatraPDF versions 3.5.0 through 3.5.2 affecting its update mechanism. The flaw disables TLS hostname verification during update checks and executes installers without verifying their digital signatures. This allows a network attacker with any valid TLS certificate, including free certificates like Let's Encrypt, to intercept update requests and inject malicious installer URLs. Successful exploitation results in arbitrary code execution on the victim's Windows system. No known exploits are currently reported in the wild. The vulnerability impacts confidentiality, integrity, and availability due to the potential for full system compromise.
ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access to it. Once accessed, the uploaded web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.
In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.