35 matches found
EUVD-2026-64335
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...
CVE-2026-53970
ZeroBrew 0.3.1 and earlier is affected by a missing integrity verification vulnerability in the Ruby compatibility shim (shim.rb). An attacker could substitute malicious content at formula resources or URL-based patch URLs without checksum validation, allowing remote code execution when downloads...
CVE-2026-53970 ZeroBrew version 0.3.1 and prior Missing Checksum Verification RCE via shim.rb
ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can...
EUVD-2026-58684
ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can...
PT-2026-72043
Name of the Vulnerable Software and Affected Versions ZeroBrew versions prior to 0.3.2 Description A missing integrity verification in the Ruby compatibility shim allows network attackers to execute arbitrary code. By substituting malicious content at formula resource or URL-based patch URLs,...
CVE-2026-50021
pnpm has an integrity check bypass when the integrity field is missing from the lockfile. Concrete details from the connected docs show that prior to versions 10.34.0 and 11.4.0, pnpm’s tarball extraction worker skips tarball hash verification if integrity is undefined, allowing an attacker who c...
CVE-2026-7574
Anthropic Claude Desktop Cowork VM images (v1.1348.0–v1.2278.0) do not validate the contents of rootfs.img at time-of-use; only file presence and a version marker are checked. A local, unprivileged macOS user can modify the VM root filesystem image and have it trusted on subsequent Cowork VM boot...
PT-2026-51611
Name of the Vulnerable Software and Affected Versions Anthropic Claude Desktop Cowork VM versions 1.1348.0 through 1.2278.0 Description The Cowork VM image handling process validates only the presence of the file and a version marker string before booting rootfs.img, failing to verify the integri...
pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies
Summary HTTP tarball dependencies and git-hosted tarballs are stored in the lockfile without integrity hashes. This allows the remote server to serve different content on each install, even when a lockfile is committed. Details When a package depends on an HTTP tarball URL, pnpm's tarball resolve...
EUVD-2025-25614
Malicious code in bioql PyPI...
EUVD-2025-24585
Malicious code in bioql PyPI...
CVE-2025-55581
D-Link DCS-825L firmware version 1.08.01 and possibly prior versions contain an insecure implementation in the mydlink-watch-dog.sh script. The script monitors and respawns the dcp and signalc binaries without validating their integrity, origin, or permissions. An attacker with filesystem access...
CVE-2025-48500
A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker with access to the local file system to replace it with a malicious package installer. Note: Software versions which have reached End of Technical Support Eo...
F5 Networks BIG-IP : BIG-IP APM VPN browser client for macOS vulnerability (K000151782)
The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.10.8 / 16.1.6.1 / 17.1.3 / 17.5.1.3. It is, therefore, affected by a vulnerability as referenced in the K000151782 advisory. A missing file integrity check vulnerability exists on the macOS F5 VPN browser client...
CVE-2025-48500
A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker with access to the local file system to replace it with a malicious package installer. Note: Software versions which have reached End of Technical Support...
CVE-2022-2793
Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no authentication or authorization of data packets after establishing a connection for the SRTP protocol...
FreeFrom Security Vulnerabilities
FreeFrom is an application from FreeFrom, Inc. dedicated to bringing privacy and free speech back to SNSs. A security vulnerability exists in FreeFrom the nostr client prior to version 1.3.5 that stems from the application having a dependency on obfuscating or encrypting security-related input...
The vulnerability of the microprogrammed Ethernet receiver software from the Trio Q, Trio E, and Trio J series lies in the fact that code can be loaded without any checks for its integrity. This allows a hacker to inject additional code into the device’s firmware.
The vulnerability of the microprogrammed Ethernet receiver software from the Trio Q, Trio E, and Trio J series is related to the loading of code without checking its integrity. Exploiting this vulnerability allows a remote attacker to inject additional code into the device’s firmware...
CVE-2023-46144
A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering station and the connected devices...