Skip to content
CVE Tracker

CWE-494

256 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 4 of them as exploited in the wild.

All 256 in the listAtom feed of new CVEsWhat CWE-494 is, at MITRE (opens in a new tab)
Published CVEs
256
Last 12 months
92
Critical
44
Known exploited
4

Critical 44High 150Medium 52Low 10Not scored 0

CVEs per yearBy the year they were published

  1. 20175
  2. 20185
  3. 20182
  4. 20191
  5. 202017
  6. 202134
  7. 202217
  8. 202430
  9. 202519
  10. 202672
  11. 202637
  12. 202612

Known exploitedNewest addition to KEV first

  • CVE-2026-3502

    TrueConf Client Update Integrity Verification Bypass

    TrueConf · TrueConf Client

    ExploitedHigh7.8
  • CVE-2025-15556

    Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification

    notepad-plus-plus · notepad-plus-plus

    ExploitedHigh7.7
  • CVE-2022-40799

    Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device.

    Product not named

    ExploitedHigh8.8
  • CVE-2021-44168

    A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated…

    Fortinet · Fortinet FortiOS

    ExploitedLow3.3

Newest CVEs

  • CVE-2026-92092

    Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification

    Red Hat · Red Hat OpenShift Container Platform 4

    High7.4
  • CVE-2026-55981

    Firmware verification vulnerability

    Creative Labs · Creative Sound Blaster Katana V2, V2X, SE

    Critical9.6
  • CVE-2026-113717

    virtualenv: Pip seeding with download omits wheel digest verification

    pypa · virtualenv

    Low2.3
  • CVE-2026-105036

    EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks

    EnergizeLab · Robot firmware (mode 104000)

    High7.5
  • CVE-2026-93649

    In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the…

    Eclipse Foundation · Adoptium Temurin

    High7.5
  • CVE-2026-86063

    Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

    anthropics · claude-code

    High7.5
  • CVE-2026-110102

    powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer

    romkatv · powerlevel10k

    High7.7
  • CVE-2026-108160

    AstronRPA through 1.1.6 Unsigned Update Installation via Plain-HTTP Feed

    iflytek · astron-rpa

    High7.7
  • CVE-2026-107812

    Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM

    0xJacky · nginx-ui

    High7.5
  • CVE-2026-29797

    Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Check

    Red Lion Controls · 700 Series

    High8.4

Vendors it comes up for most

  1. Buildroot6
  2. Microsoft6
  3. Dell4
  4. Huawei4
  5. Jenkins Project4
  6. PHOENIX CONTACT4
  7. TOBESOFT4
  8. ConnectWise3
  9. Red Hat3
  10. Schneider Electric3