Total
194 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-28236 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| Nautel VX Series transmitters VX SW v6.4.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the firmware update process. This vulnerability allows attackers to execute arbitrary code via supplying a crafted update package to the /#/software/upgrades endpoint. | |||||
| CVE-2025-27593 | 2026-06-17 | N/A | 9.3 CRITICAL | ||
| The product can be used to distribute malicious code using SDD Device Drivers due to missing download verification checks, leading to code execution on target systems. | |||||
| CVE-2025-1058 | 2026-06-17 | N/A | 8.1 HIGH | ||
| CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is downloaded. | |||||
| CVE-2025-15575 | 2026-06-17 | N/A | 5.3 MEDIUM | ||
| The firmware update functionality does not verify the authenticity of the supplied firmware update files. This allows attackers to flash malicious firmware update files on the device. Initial analysis of the firmware update functionality does not show any cryptographic checks (e.g. digital signature checks) on the supplied firmware update files. Furthermore, ESP32 security features such as secure boot are not used. | |||||
| CVE-2025-15556 | 1 Notepad-plus-plus | 1 Notepad\+\+ | 2026-06-17 | N/A | 7.5 HIGH |
| Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and installers are not cryptographically verified. An attacker able to intercept or redirect update traffic can cause the updater to download and execute an attacker-controlled installer, resulting in arbitrary code execution with the privileges of the user. | |||||
| CVE-2025-14265 | 1 Connectwise | 1 Screenconnect | 2026-06-17 | N/A | 9.1 CRITICAL |
| In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed. | |||||
| CVE-2025-11493 | 1 Connectwise | 1 Automate | 2026-06-17 | N/A | 8.8 HIGH |
| The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This creates a risk where an on-path attacker could perform a man-in-the-middle attack and substitute malicious files for legitimate ones by impersonating a legitimate server. This risk is mitigated when HTTPS is enforced and is related to CVE-2025-11492. | |||||
| CVE-2025-11182 | 2026-06-17 | N/A | 6.5 MEDIUM | ||
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Download of Code Without Integrity Check vulnerability in GTONE ChangeFlow allows Path Traversal.This issue affects ChangeFlow: All versions to v9.0.1.1. | |||||
| CVE-2025-10539 | 1 Draugiemgroup | 1 Desktime Time Tracking | 2026-06-17 | N/A | 4.8 MEDIUM |
| Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client. | |||||
| CVE-2024-55459 | 1 Keras | 1 Keras | 2026-06-17 | N/A | 6.5 MEDIUM |
| An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_file function. | |||||
| CVE-2024-54126 | 2026-06-17 | N/A | N/A | ||
| This vulnerability exists in the TP-Link Archer C50 due to improper signature verification mechanism in the firmware upgrade process at its web interface. An attacker with administrative privileges within the router’s Wi-Fi range could exploit this vulnerability by uploading and executing malicious firmware which could lead to complete compromise of the targeted device. | |||||
| CVE-2024-52583 | 2026-06-17 | N/A | 8.2 HIGH | ||
| The WesHacks GitHub repository provides the official Hackathon competition website source code for the Muweilah Wesgreen Hackathon. The page `schedule.html` before 17 November 2024 or commit 93dfb83 contains links to `Leostop`, a site that hosts a malicious injected JavaScript file that occurs when bootstrap is run as well as jquery. `Leostop` may be a tracking malware and creates 2 JavaScript files, but little else is known about it. The WesHacks website remove all references to `Leostop` as of 17 November 2024. | |||||
| CVE-2024-52331 | 1 Ecovacs | 28 Airbot Andy, Airbot Andy Firmware, Airbot Ava and 25 more | 2026-06-17 | N/A | 7.5 HIGH |
| ECOVACS robot lawnmowers and vacuums use a deterministic symmetric key to decrypt firmware updates. An attacker can create and encrypt malicious firmware that will be successfully decrypted and installed by the robot. | |||||
| CVE-2024-50696 | 1 Sungrowpower | 2 Winet-s, Winet-s Firmware | 2026-06-17 | N/A | 7.5 HIGH |
| SunGrow WiNet-S V200.001.00.P025 and earlier versions is missing integrity checks for firmware upgrades. Sending a specific MQTT message allows an update to an inverter or a WiNet connectivity dongle with a bogus firmware file that is located on attacker-controlled server. | |||||
| CVE-2024-48974 | 2026-06-17 | N/A | 9.3 CRITICAL | ||
| The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force unauthorized changes to the device's configuration settings and/or compromise device functionality by pushing a compromised/illegitimate firmware file. This could disrupt the function of the device and/or cause unauthorized information disclosure. | |||||
| CVE-2024-47192 | 1 Mahara | 1 Mahara | 2026-06-17 | N/A | 5.3 MEDIUM |
| An issue was discovered in Mahara 23.04.8 and 24.04.4. The use of a malicious export download URL can allow an attacker to download files that they do not have permission to download. | |||||
| CVE-2024-45321 | 1 App\ | 1 \ | 2026-06-17 | N/A | 8.1 HIGH |
| The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers. | |||||
| CVE-2024-43169 | 1 Ibm | 1 Engineering Requirements Management Doors Next | 2026-06-17 | N/A | 8.8 HIGH |
| IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a user to download a malicious file without verifying the integrity of the code. | |||||
| CVE-2024-42183 | 2026-06-17 | N/A | 2.5 LOW | ||
| BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability. It could allow a malicious operator to download files from arbitrary URLs without any proper validation or allowlist controls. | |||||
| CVE-2024-39819 | 1 Zoom | 3 Meeting Software Development Kit, Rooms, Workplace Desktop | 2026-06-17 | N/A | 6.7 MEDIUM |
| Integrity check in the installer for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct a privilege escalation via local access. | |||||