NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DN...

CVE-2026-63310

NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader modu

历史摘要 · 未重新核验 · NVD

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive information vulnerability in Ozols G...

CVE-2026-22306

Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext trans

历史摘要 · 未重新核验 · NVD

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into...

CVE-2026-76241

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second

历史摘要 · 未重新核验 · NVD

atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)

The HTTP MCP server-registry backend factory (`atomic_agents/mcp_registry/http.py`, `make_http_mcp_server_registry_backe

历史摘要 · 未重新核验 · GitHub Advisory

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the...

CVE-2026-53970

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim

历史摘要 · 未重新核验 · GitHub Advisory

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code b...

CVE-2026-53970

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim

历史摘要 · 未重新核验 · NVD

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading...

CVE-2026-13433

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when c

历史摘要 · 未重新核验 · GitHub Advisory

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use ...

CVE-2026-13433

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when c

历史摘要 · 未重新核验 · NVD

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability that allo...

CVE-2026-48046

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contai

历史摘要 · 未重新核验 · NVD

eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch ...

CVE-2026-0392

eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is

历史摘要 · 未重新核验 · NVD

In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5...

CVE-2026-12259

In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to

历史摘要 · 未重新核验 · NVD

phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_AD...

CVE-2026-66398

phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated

历史摘要 · 未重新核验 · NVD

FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, artifacts built from untrusted pull request code in .github...

CVE-2026-50562

FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, ar

历史摘要 · 未重新核验 · NVD

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

CVE-2026-55698

## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expec

历史摘要 · 未重新核验 · GitHub Advisory

pnpm: Repository-controlled configDependencies can select a pacquet native install engine

CVE-2026-55697

## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expec

历史摘要 · 未重新核验 · GitHub Advisory

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version...

CVE-2021-47987

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the of

历史摘要 · 未重新核验 · GitHub Advisory

Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags...

CVE-2021-47986

Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the reposit

历史摘要 · 未重新核验 · GitHub Advisory

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork...

CVE-2021-47987

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the of

历史摘要 · 未重新核验 · NVD

Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a personal fork. Attack...

CVE-2021-47986

Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the reposit

历史摘要 · 未重新核验 · NVD

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap metadata in the first YAML document of pnpm-lock.yaml. Before the patch, direc...

CVE-2026-55698

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap metadata in the first

历史摘要 · 未重新核验 · NVD