CVE-2026-128909

DJI AeroScope Mobile: Firmware updates are not signature-verified

Improper verification of cryptographic signature (CWE-347) in the firmware update handler of the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an unauthenticated attacker on the local network to install modified firmware, which gives persistent code execution as root. The device accepts any image that matches an MD5 checksum supplied in the same request and does not verify a signature. Exploitation requires network access to TCP port 16000 on the board and that the unit is not connected to another controlling host. Reproduced by running the unmodified device binaries in emulation; not tested on a physical device. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125958

Root RCE via unsigned NSP upgrade package upload

Download of code without integrity check vulnerability in N-able N-central allows Remote Code Inclusion. This issue affects N-central: through 24.6.1.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

N-able

Products

N-central

CVE-2026-109518

APT RCE via hard link reuse

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Debian Ubuntu

Products

Apt Apt

CVE-2026-121688

CVE-2026-121688

FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Frodobots

Products

Frodobots Earthrover Mini+ Firmware

CVE-2026-32148

Lockfile checksums not verified in Hex allows dependency integrity bypass

Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums. Hex stores checksums for dependencies in the mix.lock file to ensure reproducible and integrity-checked builds. However, Hex.RemoteConverger.verify_resolved/2 never executes checksum verification because the lock data returned by Hex.Utils.lock/1 uses string-based dependency names, while the verification logic compares against atom-based names. This type mismatch causes the verification code path to be silently skipped. Checksums are still validated when packages are initially downloaded from the registry, but mismatches between the lockfile and resolved dependencies are not detected. An attacker who can influence cached packages (e.g., via local cache poisoning or a compromised registry) can provide modified dependency contents that will be accepted without detection. The mix.lock file is silently rewritten with the checksum values from the registry, erasing evidence of tampering. This issue affects hex: from 0.16.0 before 2.4.2.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed

Vendors

Hex Hexpm

Products

Hex Hex

CVE-2026-92092

Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification

A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or compromising the HTTP server providing these scripts, could substitute an arbitrary executable. This malicious executable would then run with the installer's user ID (UID) and full cluster-provisioning privileges, leading to arbitrary code execution.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Openshift Container Platform

CVE-2026-121750

nvm install --offline installs a cached tarball that previously failed checksum verification

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.5 through 0.40.8, `nvm_download_artifact` downloads a release archive directly to its final path in `$NVM_DIR/.cache` and verifies its checksum afterwards; on a checksum mismatch it reports an error but leaves the rejected archive in place. A later `nvm install --offline` of the same version installs that cached file without a checksum, so an archive that was just rejected gets installed and its `node` and `npm` run. This gives code execution to a party who can alter the downloaded tarball (for example a poisoned CDN or cache object) but cannot also forge the `SHASUMS256.txt` beside it, if the victim runs `nvm install --offline` for that version after the visible "Checksums do not match" failure and before any online retry. Version 0.41.0 only puts an archive in the cache once its checksum has passed.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Nvm-sh

Products

Nvm

CVE-2026-87059

olm-operator-konflux-sample: olm-operator-konflux-sample: Unpinned pip dependency installation in bundle builder stage

A flaw was found in olm-operator-konflux-sample. The bundle builder stage installs and upgrades Python packages using pip, a package installer, without verifying their versions or using hash verification. This allows a malicious or compromised package to be introduced into the build process undetected, potentially leading to a supply chain compromise where untrusted code is incorporated into software builds.

CVSS 3.1 · 2.6 Low EPSS n/a KEV · Not listed

Vendors

Olm-operator-konflux-sample

Products

Olm-operator-konflux-sample

CVE-2026-118462

AIS update mechanism executes unverified code

Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Infantia Phronesis Profim and 1 more

CVE-2026-118791

Insecure software update mechanism

The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Compugroup Medical

Products

Wingesfar

CVE-2026-112170

Improper verification of downloaded upgrades

The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Galeno Sistemi

Products

Magistra

CVE-2026-123508

Vikunja before 2.7.1 Supply Chain Risk via Unpinned xgo Release Toolchain

Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject malicious code into subsequently built release binaries shipped under a valid signature.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Go-vikunja Vikunja

Products

Vikunja Vikunja

CVE-2026-105137

Laradock Build Process Dockerfile code download

A vulnerability was found in Laradock up to 20.4. Impacted is an unknown function of the file workspace/Dockerfile of the component Build Process. The manipulation results in download of code without integrity check. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit has been made public and could be used. Upgrading to version 20.5 is recommended to address this issue. The patch is identified as c3494f432668472056aa0a9134ff4e0d9d2e8cea. You should upgrade the affected component. The vendor confirms: "The fix replaces the reported plaintext Event and New Relic downloads with HTTPS-only downloads and checks pinned SHA-256 hashes before extracting the archives. We also fixed the Event download in the PHP-FPM Dockerfile, in addition to the locations you identified."

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Laradock

Products

Laradock

CVE-2026-104657

Missing Integrity Verification in Progress Software Fiddler Download & Setup Skill

Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at a predictable path and installs it with administrator privileges, which may allow code execution with root privileges after user approval. A local process may also replace the staged macOS package while the skill waits for approval.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Progress Software

Products

Fiddler Download & Setup Skill

CVE-2022-30267

Emerson Ovation Insufficient Verification of Data Authenticity

Emerson Ovation  was found to have no authentication of firmware signing and relies on an insecure checksum for integrity. This could allow an attacker to push malicious firmware images, cause a denial-of-service condition, or achieve remote code execution.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-113957

Unverified Image Content Delivery via Digest in Apple Container Tool

An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one they pinned. The fix compares the returned digest to the pinned digest and fails the pull on a mismatch. Tag pulls are exempt, because a tag is mutable by design. The fix also verifies the hash of manifests and blobs when they are fetched. This vulnerability is addressed in container version 1.6.0 and containerization version 0.52.1.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Container Containerization

CVE-2026-110022

Signed plug-in validation bypass

The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verification. An unauthenticated local attacker can replace an unsigned DLL outside the signed prefix in the archive passes verification and overwrites the legitimate signed assembly at the same destination path. The plugin loader then instantiates the attacker-supplied code without any additional integrity check resulting in a full compromise of the affected systems.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Phoenix Contact Phoenixcontact

Products

Plcnext Engineer Plcnext Engineer

CVE-2026-50573

pnpm: Unsafe default behavior breaks integrity check

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, `pnpm install` in non-frozen mode can accept new remote package content after detecting that the downloaded tarball does not match the integrity recorded in pnpm-lock.yaml. When a package is already locked with an integrity value, and the registry later serves different metadata and tarball content for the same package name and version, pnpm initially reports an integrity mismatch. However, plain pnpm install then performs a resolution repair, accepts the registry's new integrity, updates the lockfile, installs the new content, and exits successfully. This means the lockfile integrity check does not act as a hard stop by default. This vulnerability is fixed in 10.34.0 and 11.4.0.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Pnpm

Products

Pnpm

CVE-2026-50021

pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's tarball extraction worker skips integrity verification when the integrity field is absent from the lockfile resolution. If an attacker can both modify pnpm-lock.yaml to remove the integrity: field and cause the referenced registry URL to serve altered package content, pnpm install --frozen-lockfile can install the altered package without an integrity error. npm's npm ci enforces integrity by default; pnpm's behavior of silently skipping verification is a pnpm-specific fail-open gap. This vulnerability is fixed in 10.34.0 and 11.4.0.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Pnpm

Products

Pnpm

CVE-2025-14265

Improper server-side validation in ScreenConnect extension framework

In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 introduces enhanced server-side configuration handling and integrity checks to ensure only trusted extensions can be installed.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Connectwise

Products

Screenconnect