Monthly
Remote code execution via a download-without-integrity-check flaw affects Dell Secure Connect Gateway (SCG) 5.0 in both its Appliance and Application deployment forms. An unauthenticated network-adjacent attacker who can achieve a man-in-the-middle position between the SCG system and Dell's update infrastructure can substitute malicious code for legitimate downloads, leading to command execution on the appliance. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H) captures the high attack complexity from the MITM requirement alongside the absence of authentication prerequisites. No public exploit has been identified at time of analysis.
Unsigned code execution on Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) is possible when an attacker with physical access triggers a special maintenance boot mode via a hardware key sequence. In this mode the relay unconditionally downloads and executes code from a network server with no cryptographic signature or integrity verification, fully satisfying CWE-494. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; risk is bounded by the physical-access prerequisite but is severe once that barrier is crossed in OT substation environments.
Remote code execution in MOOS essential-moos pAntler through 10.0.1 lets unauthenticated attackers run arbitrary programs on a robot/vehicle host by publishing a crafted MISSION_FILE variable to the MOOSDB. pAntler's headless remote-control path parses the mission file's Run entries and launches them via execvp() with no check on who published the message, so anyone able to write to the MOOSDB can spawn processes. Reported by VulnCheck with an upstream fix (PR #17); no public exploit identified at time of analysis and it is not in CISA KEV.
Supply-chain remote code execution affects NousResearch Hermes Agent versions 0.18.2 through 0.18.x (prior to 0.19.0), where the bundled MCP catalog references a third-party upstream repository via a mutable git branch instead of a pinned commit SHA. An attacker who compromises that upstream repository can push malicious code that is automatically pulled onto every host installing the affected catalog entry, achieving code execution with no further operator action. Reported by VulnCheck; a vendor patch exists (v0.19.0) but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Spring for GraphQL's bundled GraphiQL developer IDE loads third-party JavaScript libraries from a public CDN without Subresource Integrity (SRI) verification, allowing any attacker capable of tampering with CDN responses to inject and execute arbitrary JavaScript in any browser that loads the GraphiQL page. All four maintained release lines are affected (1.0.x through 2.0.4), as confirmed by the VMware/Spring security advisory and EUVD-2026-67175. No public exploit code has been identified at time of analysis, and EPSS at 0.11% (2nd percentile) reflects currently minimal exploitation activity.
Remote code execution in Time4Popcorn - a Popcorn Time media-streaming fork - affects the Windows client (<= 6.2.1.18), macOS client (<= 6.2.1.17), and Android client (<= 3.5.0.173) through the application's auto-update mechanism (updater.exe on Windows, the PT.updd component on macOS). Because the updater fetches and executes update payloads without verifying their integrity (CWE-494), an attacker able to influence the update channel can deliver and run arbitrary code on the victim host. No CISA KEV listing, no public exploit is identified at time of analysis, and EPSS is low at 0.26% (18th percentile).
Untrusted code execution in NVIDIA NemoClaw for Linux (versions up to and including 0.0.21) stems from the installer executing code without verifying its integrity, letting an attacker who can supply or interpose malicious code during installation achieve arbitrary code execution, privilege escalation, data tampering, information disclosure, and denial of service. NVIDIA assigns a CVSS of 9.8 with a fully network-based, no-privilege, no-interaction vector, though the flaw is rooted in the install process. There is no public exploit identified at time of analysis, EPSS is low at 0.25% (17th percentile), and CISA SSVC records no known exploitation.
Unverified code download in NVIDIA NemoClaw installation scripts for Linux (versions 0.0.0 through 0.0.21) allows a network-positioned attacker to substitute malicious payloads during installation, enabling code execution, privilege escalation, information disclosure, and data tampering on the target host. The root cause is CWE-494: the installation pipeline fetches remote code without cryptographic integrity verification, leaving the download channel open to man-in-the-middle substitution or upstream server compromise. No public exploit has been identified at time of analysis; EPSS sits at 0.20% (9th percentile) and SSVC confirms Exploitation: none, placing this firmly in the theoretical high-severity category rather than an actively exploited threat.
Arbitrary code injection in the Natural Language Toolkit (NLTK) before 3.9.3 stems from the downloader module extracting downloaded corpora and model packages without verifying their integrity, allowing an attacker positioned to tamper with the download (man-in-the-middle or DNS poisoning) to substitute malicious archive contents that are unpacked onto the victim host. All NLTK versions prior to 3.9.3 are affected (CWE-494). Reported by VulnCheck; a vendor patch exists, but no public exploit has been identified and it is not listed in CISA KEV.
Remote code execution in Ozols Grupa OZOLS on Windows (all versions before 1.1.1233) stems from an abandoned automatic-update domain that the OzolsSQL client still trusts. Because updates are pulled over cleartext with no integrity or signature check, anyone who re-registers the lapsed domain (or performs a network MITM) can serve a malicious serv_update.vbs that the <db>_update SQL Server Agent job executes as ActiveScripting, yielding full host compromise. The flaw carries a CVSS 4.0 base of 10.0; it was reported by ENISA (EUVD-2026-62704) with a vendor patch available, and no public exploit or CISA KEV listing is identified at time of analysis.
Remote code execution via a download-without-integrity-check flaw affects Dell Secure Connect Gateway (SCG) 5.0 in both its Appliance and Application deployment forms. An unauthenticated network-adjacent attacker who can achieve a man-in-the-middle position between the SCG system and Dell's update infrastructure can substitute malicious code for legitimate downloads, leading to command execution on the appliance. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H) captures the high attack complexity from the MITM requirement alongside the absence of authentication prerequisites. No public exploit has been identified at time of analysis.
Unsigned code execution on Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) is possible when an attacker with physical access triggers a special maintenance boot mode via a hardware key sequence. In this mode the relay unconditionally downloads and executes code from a network server with no cryptographic signature or integrity verification, fully satisfying CWE-494. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; risk is bounded by the physical-access prerequisite but is severe once that barrier is crossed in OT substation environments.
Remote code execution in MOOS essential-moos pAntler through 10.0.1 lets unauthenticated attackers run arbitrary programs on a robot/vehicle host by publishing a crafted MISSION_FILE variable to the MOOSDB. pAntler's headless remote-control path parses the mission file's Run entries and launches them via execvp() with no check on who published the message, so anyone able to write to the MOOSDB can spawn processes. Reported by VulnCheck with an upstream fix (PR #17); no public exploit identified at time of analysis and it is not in CISA KEV.
Supply-chain remote code execution affects NousResearch Hermes Agent versions 0.18.2 through 0.18.x (prior to 0.19.0), where the bundled MCP catalog references a third-party upstream repository via a mutable git branch instead of a pinned commit SHA. An attacker who compromises that upstream repository can push malicious code that is automatically pulled onto every host installing the affected catalog entry, achieving code execution with no further operator action. Reported by VulnCheck; a vendor patch exists (v0.19.0) but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Spring for GraphQL's bundled GraphiQL developer IDE loads third-party JavaScript libraries from a public CDN without Subresource Integrity (SRI) verification, allowing any attacker capable of tampering with CDN responses to inject and execute arbitrary JavaScript in any browser that loads the GraphiQL page. All four maintained release lines are affected (1.0.x through 2.0.4), as confirmed by the VMware/Spring security advisory and EUVD-2026-67175. No public exploit code has been identified at time of analysis, and EPSS at 0.11% (2nd percentile) reflects currently minimal exploitation activity.
Remote code execution in Time4Popcorn - a Popcorn Time media-streaming fork - affects the Windows client (<= 6.2.1.18), macOS client (<= 6.2.1.17), and Android client (<= 3.5.0.173) through the application's auto-update mechanism (updater.exe on Windows, the PT.updd component on macOS). Because the updater fetches and executes update payloads without verifying their integrity (CWE-494), an attacker able to influence the update channel can deliver and run arbitrary code on the victim host. No CISA KEV listing, no public exploit is identified at time of analysis, and EPSS is low at 0.26% (18th percentile).
Untrusted code execution in NVIDIA NemoClaw for Linux (versions up to and including 0.0.21) stems from the installer executing code without verifying its integrity, letting an attacker who can supply or interpose malicious code during installation achieve arbitrary code execution, privilege escalation, data tampering, information disclosure, and denial of service. NVIDIA assigns a CVSS of 9.8 with a fully network-based, no-privilege, no-interaction vector, though the flaw is rooted in the install process. There is no public exploit identified at time of analysis, EPSS is low at 0.25% (17th percentile), and CISA SSVC records no known exploitation.
Unverified code download in NVIDIA NemoClaw installation scripts for Linux (versions 0.0.0 through 0.0.21) allows a network-positioned attacker to substitute malicious payloads during installation, enabling code execution, privilege escalation, information disclosure, and data tampering on the target host. The root cause is CWE-494: the installation pipeline fetches remote code without cryptographic integrity verification, leaving the download channel open to man-in-the-middle substitution or upstream server compromise. No public exploit has been identified at time of analysis; EPSS sits at 0.20% (9th percentile) and SSVC confirms Exploitation: none, placing this firmly in the theoretical high-severity category rather than an actively exploited threat.
Arbitrary code injection in the Natural Language Toolkit (NLTK) before 3.9.3 stems from the downloader module extracting downloaded corpora and model packages without verifying their integrity, allowing an attacker positioned to tamper with the download (man-in-the-middle or DNS poisoning) to substitute malicious archive contents that are unpacked onto the victim host. All NLTK versions prior to 3.9.3 are affected (CWE-494). Reported by VulnCheck; a vendor patch exists, but no public exploit has been identified and it is not listed in CISA KEV.
Remote code execution in Ozols Grupa OZOLS on Windows (all versions before 1.1.1233) stems from an abandoned automatic-update domain that the OzolsSQL client still trusts. Because updates are pulled over cleartext with no integrity or signature check, anyone who re-registers the lapsed domain (or performs a network MITM) can serve a malicious serv_update.vbs that the <db>_update SQL Server Agent job executes as ActiveScripting, yielding full host compromise. The flaw carries a CVSS 4.0 base of 10.0; it was reported by ENISA (EUVD-2026-62704) with a vendor patch available, and no public exploit or CISA KEV listing is identified at time of analysis.