CWE-494 Download of Code Without Integrity Check

Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM

virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

Duplicate Advisory: NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

Duplicate Advisory: NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)

pnpm: Repository-controlled configDependencies can select a pacquet native install engine

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

Withdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY

Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark

ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack

stigmem-node's unsigned plugin override could be enabled without a second explicit acknowledgment

apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

Axios npm Supply Chain Incident Impacting @usebruno/cli

pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies

Sinatra vulnerable to Reflected File Download attack

RuoYi vulnerable to arbitrary file download

Gradio lacks integrity checking on the downloaded FRP client

Django vulnerable to Reflected File Download attack

Cargo prior to Rust 1.26.0 may download the wrong dependency

WP Crontrol vulnerable to possible RCE when combined with a pre-condition

RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application

Jenkins Plugin Installation Manager Tool did not verify plugin downloads

Artifact Hub has Incorrect Docker Hub registry check