Skip to content
BackEsc
Sign in

CWE-494 · weakness in Supply Chain and Malicious Code

Download of Code Without Integrity Check

236 CVEs · 4 exploited

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
4
check available
1

Every one of the 236 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device.CVE-2022-40799D-Link · CVSS 8.8 · 34% likely

    D-Link

  2. TrueConf Client Update Integrity Verification BypassCVE-2026-3502TrueConf · CVSS 7.8 · 5.8% likelycovered by CyberSIXT

    TrueConf

  3. Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity VerificationCVE-2025-15556notepad-plus-plus · CVSS 7.7 · 1.7% likelycovered by CyberSIXT

    Notepad-Plus-Plus

  4. A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbi…CVE-2021-44168Fortinet · CVSS 3.3 · 0.9% likely

    Fortinet

  5. Oliver 5 Library Server <8.00.008.053 - Local File InclusionCVE-2021-450272.0% likely
  6. The Miss Marple Updater Service in COMPAREX Miss Marple Enterprise Edition before 2.0 allows remote attackers to execute arbitrary code with SYSTEM privileges via vectors related…CVE-2018-192343.3% likely
  7. SHDesigns' Resident Download Manager (as well as the Ethernet Download Manager) does not authenticate firmware downloads before executing code and deploying them to devicesCVE-2016-6567SHDesigns · 2.9% likely
  8. Ragentek Android software contains an over-the-air update mechanism that communicates over an unencrypted channel, which can allow a remote attacker to execute arbitrary code with…CVE-2016-6564Ragentek · 2.6% likely
  9. Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download files, which allows remote attackers to execute arbitrary code via DNS spoofing of the…CVE-2001-1125CVSS 9.8 · 2.5% likely
  10. Microsoft SharePoint Remote Code Execution VulnerabilityCVE-2020-1453Microsoft · CVSS 8.6 · 2.2% likely

    Microsoft

  11. Microsoft SharePoint Remote Code Execution VulnerabilityCVE-2020-1452Microsoft · CVSS 8.6 · 2.2% likely

    Microsoft

  12. Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution vulnerabi…CVE-2022-274382.1% likely
  13. Microsoft SharePoint Remote Code Execution VulnerabilityCVE-2020-1200Microsoft · CVSS 8.6 · 2.1% likely

    Microsoft

  14. Microsoft SharePoint Remote Code Execution VulnerabilityCVE-2020-1595Microsoft · CVSS 9.9 · 2.0% likely

    Microsoft

  15. The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 allows remote code execution via the backup functionality in the web frontend. By using an exploit chain, an attacker wi…CVE-2020-94741.9% likely
  16. Microsoft SharePoint Remote Code Execution VulnerabilityCVE-2020-1210Microsoft · CVSS 9.9 · 1.9% likely

    Microsoft

  17. ZZ Inc. KeyMouse Windows 3.08 and prior is affected by a remote code execution vulnerability during an unauthenticated update. To exploit this vulnerability, a user must trigger a…CVE-2022-246441.9% likely
  18. Microsoft SharePoint Remote Code Execution VulnerabilityCVE-2020-1576Microsoft · CVSS 8.5 · 1.6% likely

    Microsoft

  19. Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Package Builder for Windows 9.1.4 and Remote Installer for Wind…CVE-2022-289441.6% likely
  20. Update package downgrade in Zoom Client for Meetings for WindowsCVE-2022-22786Zoom Video Communications Inc · CVSS 7.5 · 1.5% likely

    Zoom Video Communications, Inc.

  21. The PartyGaming PartyPoker client program 121/120 does not properly verify the authenticity of updates, which allows remote man-in-the-middle attackers to execute arbitrary code v…CVE-2008-33241.4% likely
  22. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required…CVE-2020-10926NETGEAR · CVSS 7.5 · 1.2% likely

    NETGEAR

  23. Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to do…CVE-2020-88091.2% likely
  24. Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an XML document describ…CVE-2021-338791.2% likely
  25. MajorDoMo Supply Chain Remote Code Execution via Update URL PoisoningCVE-2026-27180sergejey · CVSS 9.8 · 1.2% likely

    Sergejey

  26. A CWE-494: Download of Code Without Integrity Check vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause unauthoriz…CVE-2020-28213PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) · 1.2% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in