CWE-494

CWE-494 · 3 records · 2 with a public proof-of-concept

Records the NVD classes under CWE-494, highest CVSS first.

  1. HIGH 8.8CVE-2026-96455public PoC2026-09-23

    The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy_mini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Depends(get_app_manager), which just han…

    AI risk analysis on Exploit-DB.ai →

  2. HIGH 7.5CVE-2026-921282026-09-16

    Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing attackers able to define classpath entries t…

    script security

    AI risk analysis on Exploit-DB.ai →

  3. HIGH 7.1CVE-2026-49450public PoC2026-09-21

    Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Desktop for Windows omits publisherName from packages/app-desktop/package.json, so the generated app-update.yml causes NsisUpdater.…

    AI risk analysis on Exploit-DB.ai →