CWE-494

Download of Code Without Integrity Check

41 CVEs Avg CVSS 7.2 MITRE
9
CRITICAL
20
HIGH
5
MEDIUM
6
LOW
9
POC
2
KEV

Monthly

CVE-2026-34841 CRITICAL PATCH GHSA Act Now

Supply chain compromise of @usebruno/cli (Bruno API testing tool) deployed a cross-platform Remote Access Trojan via malicious axios dependency versions 1.14.1 and 0.30.4 on npm during a 3-hour window (00:21-03:30 UTC, March 31, 2026). Unauthenticated remote attackers gained full system compromise including credential exfiltration and persistent RAT installation on affected developer workstations. No public exploit code required as the malicious payload executed automatically via npm postinstall scripts. CVSS 9.8 Critical rating reflects network-accessible attack requiring no authentication or user interaction. Vendor-released patch available (PR #7632) pins axios to safe versions; compromised packages removed from npm registry. Organizations using Bruno CLI must assume breach during the attack window and initiate incident response procedures including credential rotation and system forensics.

Node.js Information Disclosure
NVD GitHub VulDB
CVSS 3.1
9.8
EPSS
0.0%
CVE-2026-3502 HIGH POC KEV THREAT NEWS Act Now

Arbitrary code execution in TrueConf Client allows authenticated attackers on adjacent networks to deliver malicious updates due to missing integrity verification. The auto-update mechanism accepts unsigned or unverified payloads, enabling man-in-the-middle attackers with high privileges to substitute trojanized updates that execute with the application's permissions. EPSS data not available; no confirmed active exploitation (not in CISA KEV); publicly available exploit code not identified at time of analysis. CVSS 7.8 reflects the adjacent network attack vector and user interaction requirement, reducing immediate internet-scale risk.

RCE
NVD VulDB GitHub
CVSS 3.1
7.8
EPSS
0.0%
Threat
4.6
CVE-2026-33075 HIGH This Week

FastGPT versions 4.14.8.3 and below contain a critical arbitrary code execution vulnerability in the fastgpt-preview-image.yml GitHub Actions workflow that allows external contributors to execute malicious code and exfiltrate repository secrets. The vulnerability stems from unsafe use of pull_request_target with attacker-controlled Dockerfile builds that are pushed to the production container registry, enabling both direct compromise and supply chain attacks. No patch was available at the time of public disclosure, making this an unpatched remote code execution affecting the AI Agent building platform across affected versions.

RCE Docker
NVD GitHub VulDB
CVSS 3.1
8.8
EPSS
0.0%
CVE-2026-1878 Monitor

An Insufficient Integrity Verification vulnerability in the ASUS ROG peripheral driver installation process allows privilege escalation to SYSTEM. The vulnerability is due to improper access control on the installation directory, which enables the exploitation of a race condition where the legitimate installer is substituted with an unexpected payload immediately after download, resulting in arbitrary code execution. Refer to the "Security Update for ASUS ROG peripheral driver" section on the...

Privilege Escalation
NVD VulDB
EPSS
0.0%
CVE-2026-3000 CRITICAL PATCH Act Now

IDExpert Windows Logon Agent has a second RCE vulnerability through another unsigned code download path.

Windows RCE Idexpert
NVD
CVSS 3.1
9.8
EPSS
0.2%
CVE-2026-2999 CRITICAL PATCH Act Now

IDExpert Windows Logon Agent by Changing has an RCE vulnerability through download of code without integrity check, allowing malicious update injection.

Windows RCE Idexpert
NVD
CVSS 3.1
9.8
EPSS
0.2%
CVE-2025-47904 MEDIUM This Month

Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5. [CVSS 4.1 MEDIUM]

Information Disclosure
NVD VulDB
CVSS 4.0
5.7
EPSS
0.0%
CVE-2026-27180 CRITICAL POC THREAT Emergency

MajorDoMo home automation platform is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method without authentication due to improper use of gr() (which reads from $_REQUEST), allowing attackers to redirect update URLs and push malicious code packages.

PHP Tls RCE Majordomo
NVD GitHub
CVSS 3.1
9.8
EPSS
61.8%
Threat
5.3
CVE-2025-15575 MEDIUM This Month

The firmware update functionality does not verify the authenticity of the supplied firmware update files. This allows attackers to flash malicious firmware update files on the device. [CVSS 5.3 MEDIUM]

Information Disclosure
NVD
CVSS 3.1
5.3
EPSS
0.0%
CVE-2026-20056 MEDIUM This Month

Cisco Secure Web Appliance's DVS Engine improperly handles certain archive files, allowing unauthenticated remote attackers to bypass the anti-malware scanner and deliver malicious archives to end users. An attacker can exploit this by sending crafted archive files through affected devices to circumvent malware detection. While downloaded malware requires manual extraction and execution by the user, this vulnerability enables distribution of malicious content that would normally be blocked.

Cisco
NVD
CVSS 3.1
4.0
EPSS
0.0%
CVE-2026-34841
EPSS 0% CVSS 9.8
CRITICAL PATCH Act Now

Supply chain compromise of @usebruno/cli (Bruno API testing tool) deployed a cross-platform Remote Access Trojan via malicious axios dependency versions 1.14.1 and 0.30.4 on npm during a 3-hour window (00:21-03:30 UTC, March 31, 2026). Unauthenticated remote attackers gained full system compromise including credential exfiltration and persistent RAT installation on affected developer workstations. No public exploit code required as the malicious payload executed automatically via npm postinstall scripts. CVSS 9.8 Critical rating reflects network-accessible attack requiring no authentication or user interaction. Vendor-released patch available (PR #7632) pins axios to safe versions; compromised packages removed from npm registry. Organizations using Bruno CLI must assume breach during the attack window and initiate incident response procedures including credential rotation and system forensics.

Node.js Information Disclosure
NVD GitHub VulDB
CVE-2026-3502
EPSS 0% 4.6 CVSS 7.8
HIGH POC KEV THREAT Act Now

Arbitrary code execution in TrueConf Client allows authenticated attackers on adjacent networks to deliver malicious updates due to missing integrity verification. The auto-update mechanism accepts unsigned or unverified payloads, enabling man-in-the-middle attackers with high privileges to substitute trojanized updates that execute with the application's permissions. EPSS data not available; no confirmed active exploitation (not in CISA KEV); publicly available exploit code not identified at time of analysis. CVSS 7.8 reflects the adjacent network attack vector and user interaction requirement, reducing immediate internet-scale risk.

RCE
NVD VulDB GitHub
CVE-2026-33075
EPSS 0% CVSS 8.8
HIGH This Week

FastGPT versions 4.14.8.3 and below contain a critical arbitrary code execution vulnerability in the fastgpt-preview-image.yml GitHub Actions workflow that allows external contributors to execute malicious code and exfiltrate repository secrets. The vulnerability stems from unsafe use of pull_request_target with attacker-controlled Dockerfile builds that are pushed to the production container registry, enabling both direct compromise and supply chain attacks. No patch was available at the time of public disclosure, making this an unpatched remote code execution affecting the AI Agent building platform across affected versions.

RCE Docker
NVD GitHub VulDB
CVE-2026-1878
EPSS 0%
Monitor

An Insufficient Integrity Verification vulnerability in the ASUS ROG peripheral driver installation process allows privilege escalation to SYSTEM. The vulnerability is due to improper access control on the installation directory, which enables the exploitation of a race condition where the legitimate installer is substituted with an unexpected payload immediately after download, resulting in arbitrary code execution. Refer to the "Security Update for ASUS ROG peripheral driver" section on the...

Privilege Escalation
NVD VulDB
CVE-2026-3000
EPSS 0% CVSS 9.8
CRITICAL PATCH Act Now

IDExpert Windows Logon Agent has a second RCE vulnerability through another unsigned code download path.

Windows RCE Idexpert
NVD
CVE-2026-2999
EPSS 0% CVSS 9.8
CRITICAL PATCH Act Now

IDExpert Windows Logon Agent by Changing has an RCE vulnerability through download of code without integrity check, allowing malicious update injection.

Windows RCE Idexpert
NVD
CVE-2025-47904
EPSS 0% CVSS 5.7
MEDIUM This Month

Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5. [CVSS 4.1 MEDIUM]

Information Disclosure
NVD VulDB
CVE-2026-27180
EPSS 62% 5.3 CVSS 9.8
CRITICAL POC THREAT Emergency

MajorDoMo home automation platform is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method without authentication due to improper use of gr() (which reads from $_REQUEST), allowing attackers to redirect update URLs and push malicious code packages.

PHP Tls RCE +1
NVD GitHub
CVE-2025-15575
EPSS 0% CVSS 5.3
MEDIUM This Month

The firmware update functionality does not verify the authenticity of the supplied firmware update files. This allows attackers to flash malicious firmware update files on the device. [CVSS 5.3 MEDIUM]

Information Disclosure
NVD
CVE-2026-20056
EPSS 0% CVSS 4.0
MEDIUM This Month

Cisco Secure Web Appliance's DVS Engine improperly handles certain archive files, allowing unauthenticated remote attackers to bypass the anti-malware scanner and deliver malicious archives to end users. An attacker can exploit this by sending crafted archive files through affected devices to circumvent malware detection. While downloaded malware requires manual extraction and execution by the user, this vulnerability enables distribution of malicious content that would normally be blocked.

Cisco
NVD

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy