PT-2026-95015

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager contains an issue where the create sample file function in libmport/bundle read install pkg.c fails to constrain absolute source and destination paths from the sample-fi...

CVE-2026-54585: Improper Limitation of a Pathname to a Restricted Directory

mport is the MidnightBSD Package Manager. Prior to 2.7.8, createsamplefile in libmport/bundlereadinstallpkg.c did not constrain absolute source and destination paths from the sample-file manifest directive to mport-root. A malicious or malformed package manifest could therefore direct privileged...

CVE-2026-54586: Cleartext Transmission of Sensitive Information

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchindex, mportfetchbootstrapindex, and mportfetchbundle paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a urlishttps enforcement check. When a cleartext URL was configured or returned by...

PT-2026-95010

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager contains a flaw where the do actual install function in libmport/bundle read install pkg.c utilizes path-based lstat, chown, stat, and chmod operations during package...

PT-2026-95011

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The mport verify package function in libmport/verify.c may continue execution after MD5File or SHA256 File fails. This allows the system to compare an expected checksum against stale data remaining in...

PT-2026-94485

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the hp-bioscfg platform driver where the PSWD ENCODINGS password parser fails to properly validate bounds when copying supported password encodings from the ACPI...

CVE-2026-54583: Improper Limitation of a Pathname to a Restricted Directory

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could place an unsafe value in indexEntry-bundlefile, an...

CVE-2026-54575: Improper Neutralization of Special Elements used in an OS Command

mport is the MidnightBSD Package Manager. Prior to 2.7.8, privileged package fetch and cache-cleaning operations used race-prone path handling across libmport/fetch.c, libmport/clean.c, libmport/util.c, libmport/bundlereadinstallpkg.c, libmport/deleteprimative.c, and...

CVE-2026-90137: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix password encoding bounds check The password PSWDENCODINGS parser reads passwordobjelem + posvalues while copying the supported password encodings from the ACPI package. The outer loop only guarantees...

CVE-2026-54587: Improper Link Resolution Before File Access

mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSETDIR or ASSETDIROWNERMODE in libmport/bundlereadinstallpkg.c used path-based mportmkdirp, ownership, and permission operations. A local attacker able to modify part of the target installation tree could use...

CVE-2026-16582: Missing Authorization

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating...

PT-2026-95013

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager fails to treat all truncated, corrupt, or failed zstd streams as fatal within the mport decompress zstd function. Additionally, the libmport/fetch.c component does not...

CVE-2026-54580: Improper Validation of Integrity Check Value

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal in mportdecompresszstd, and libmport/fetch.c did not consistently propagate those failures to index-fetch callers. A malicious or faulty mirror could supply...

PT-2026-95004

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager fails to consistently reject bundle filenames that are empty or contain dots, dot-dot sequences, or slashes within the libmport/fetch.c file. This occurs because the is...

PT-2026-95003

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The mport fetch bootstrap index function in libmport/fetch.c fails to preserve a fatal result when bootstrap index hash verification encounters a missing or invalid hash, incorrectly returning success...

CVE-2026-54581: Insufficient Verification of Data Authenticity

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchbootstrapindex function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or...

PT-2026-95017

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description In the MidnightBSD Package Manager, directory assets handled as ASSET DIR or ASSET DIR OWNER MODE in the libmport/bundle read install pkg.c file utilize path-based mport mkdirp, ownership, and permissi...

PT-2026-95002

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The audit command in mport/mport.c incorrectly handles argument parsing. It computes option-adjusted local argv and local argc values but passes the original argument entry to the audit package functio...

PT-2026-95009

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description Privileged package fetch and cache-cleaning operations use race-prone path handling within libmport/fetch.c, libmport/clean.c, libmport/util.c, libmport/bundle read install pkg.c, libmport/delete...

PT-2026-95014

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager fails to perform a preflight check for non-directory assets that already exist on the disk during package installation. The logic within libmport/check preconditions.c,...