CWE-494— Download of Code Without Integrity Check
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.— MITRE CWE catalog
262 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-494page 6 of 6
- CVE-2022-46430MEDIUMCVSS 4.8EG 4.82022-12-20
TP-Link TL-WR740N V1 and V2 v3.12.4 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image during the firmware update process.
- CVE-2022-46428MEDIUMCVSS 4.8EG 4.82022-12-20
TP-Link TL-WR1043ND V1 3.13.15 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image during the firmware update process.
- CVE-2026-21810MEDIUMCVSS 4.4EG 4.42026-08-26
HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sensitive information or modify the binary.
- CVE-2017-12306MEDIUMCVSS 4.4EG 4.42017-11-16
A vulnerability in the upgrade process of Cisco Spark Board could allow an authenticated, local attacker to install an unverified upgrade package, aka Signature Verification Bypass. The vulnerability is due to insufficient upgrade package …
- CVE-2024-33660MEDIUMCVSS 4.3EG 4.32024-11-12
An exploit is possible where an actor with physical access can manipulate SPI flash without being detected.
- CVE-2023-29401MEDIUMCVSS 4.3EG 4.32023-06-08
The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-D…
- CVE-2025-47904MEDIUMCVSS 4.1EG 4.12026-02-24
Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.
- CVE-2026-20056MEDIUMCVSS 4.0EG 4.02026-02-04
A vulnerability in the Dynamic Vectoring and Streaming (DVS) Engine implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass the anti-malware scanner, allowing malici…
- CVE-2017-2739LOWCVSS 3.1EG 3.12017-11-22
The upgrade package of Huawei Vmall APP Earlier than HwVmall 1.5.3.0 versions is transferred through HTTP. A man in the middle (MITM) can tamper with the upgrade package of Huawei Vmall APP, and to implant the malicious applications.
- CVE-2024-42183LOWCVSS 2.5EG 2.52025-01-23
BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability. It could allow a malicious operator to download files from arbitrary URLs without any proper validation or allowlist controls.
- CVE-2026-113717LOWCVSS 2.3EG 2.32026-10-20
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling get_wheel(download=False) and then allowing pip to consult the configured …
- CVE-2025-52937LOWCVSS 2.0EG 2.02025-06-23
Vulnerability in PointCloudLibrary PCL (surface/src/3rdparty/opennurbs modules). This vulnerability is associated with program files crc32.C. This vulnerability is only relevant if the PCL version is older than 1.14.0 or the user specific…
Map vulnerabilities like CWE-494 to your infrastructure
EchelonGraph correlates every CVE — across CWE-494 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →