Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.5EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over…EPSS 0.2%Oct 15, 2026
- UnknownIn the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-downl…Oct 15, 2026
- High7.5Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash PinningOct 13, 2026
- High7.7Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and sk…EPSS 0.1%Oct 13, 2026
- Critical9.8Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Download of Code Without Integrity Check vulnerability.Sep 29, 2026
- Critical9.2MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary programs by publis…EPSS 0.6%Sep 3, 2026
- High7.1NLTK: Missing Post-Download Integrity Verification Allows Malicious Package InjectionAug 3, 2026
- High8.8The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations.May 21, 2026
- High7.5apko allows users to build and publish OCI container images built from apk packages.May 9, 2026
- High8.9Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums.Apr 30, 2026
- High7.7Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker‑controlled HTTP response headers.Apr 29, 2026
- High7.7Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables.Apr 29, 2026
- Medium4.8Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between…EPSS 0.2%Apr 28, 2026
- High8.8Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded.Apr 17, 2026
- Medium5.4A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member Center(华硕大厅) allows a local user to achieve privilege escalation to Admin…Apr 16, 2026
- Critical9.8Bruno is an open source IDE for exploring and testing APIs.Apr 6, 2026
- Medium6.8An issue in the firmware update mechanism of Qianniao QN-L23PA0904 v20250721.1640 allows attackers to gain root access, install backdoors, and exfiltrate data via supp…Apr 2, 2026
- High7.8TrueConf Client Download of Code Without Integrity Check VulnerabilityKEVEPSS 0.3%Mar 30, 2026
- Critical9.4FastGPT is an AI Agent building platform.Mar 20, 2026
- Critical9.1Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability.Mar 18, 2026
- Medium5.4An Insufficient Integrity Verification vulnerability in the ASUS ROG peripheral driver installation process allows privilege escalation to SYSTEM.Mar 12, 2026
- Critical9.3IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download…Mar 2, 2026
- Critical9.3IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download…Mar 2, 2026
- Medium5.7Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.EPSS 0.1%Feb 24, 2026
- High7.7Notepad++ Download of Code Without Integrity Check VulnerabilityKEVEPSS 1.8%Feb 2, 2026
29 records · page 1 of 2
PreviousNext