pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.yaml before command dispatch. Before the patch, a reposito...

CVE-2026-55697

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.y

历史摘要 · 未重新核验 · NVD

The Angular Language Service VS Code Extension provides a rich editing experience for Angular templates. Prior to 21.2.4, the client-side Angular Language Service VS Code extens...

CVE-2026-49241

The Angular Language Service VS Code Extension provides a rich editing experience for Angular templates. Prior to 21.2.4

历史摘要 · 未重新核验 · NVD

esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY

### Summary The esbuild Deno module (`lib/deno/mod.ts`) downloads native binary executables from an npm registry and wr

历史摘要 · 未重新核验 · GitHub Advisory

stigmem-node's unsigned plugin override could be enabled without a second explicit acknowledgment

### Impact A single configuration flag could disable plugin signature enforcement. If an operator unintentionally carrie

历史摘要 · 未重新核验 · GitHub Advisory

A firmware update mechanism in the affected charging controller fails to validate the authenticity of firmware packages delivered through the device's management interface. Beca...

CVE-2026-9037

A firmware update mechanism in the affected charging controller fails to validate the authenticity of firmware packages

历史摘要 · 未重新核验 · NVD

The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is addressed in Automa...

CVE-2026-9089

The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and

历史摘要 · 未重新核验 · NVD

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares in...

CVE-2026-42575

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifi

历史摘要 · 未重新核验 · NVD

apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

CVE-2026-42575

apko verifies the signature on `APKINDEX.tar.gz` but never compares individually downloaded `.apk` packages against the

历史摘要 · 未重新核验 · GitHub Advisory

Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums. Hex...

CVE-2026-32148

Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency

历史摘要 · 未重新核验 · NVD

Ollama for Windows does not perform integrity or authenticity verification of downloaded update...

CVE-2026-42248

Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike othe

历史摘要 · 未重新核验 · GitHub Advisory

Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker‑controlled HTTP response headers. When downloading...

CVE-2026-42249

Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of at

历史摘要 · 未重新核验 · NVD

Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike other platforms, the Windows implementation of the update ver...

CVE-2026-42248

Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike othe

历史摘要 · 未重新核验 · NVD

Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client...

CVE-2025-10539

Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can p

历史摘要 · 未重新核验 · NVD