CVE-2025-10539
Medium · 4.8CVSS
4.8
EPSS
0.2%
Published
Apr 28, 2026
CISA due date
—
The record
Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-96375 Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the… CWE-295
- CVE-2026-87944 Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider… CWE-295
- CVE-2026-114642 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend… CWE-295
- CVE-2026-114406 The system certificate authority (CA) store in Red Hat products, distributed via… CWE-295
- CVE-2026-95210 Improper certificate validation in gnutls v3.8.13 causes the application to accept… CWE-295
- CVE-2026-97687 urllib3 is an HTTP client library for Python. CWE-295
- CVE-2026-101916 @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a… CWE-295
- CVE-2026-63374 AnyIO is a high level asynchronous concurrency and networking framework that works on top… CWE-295