python-tuf

A Framework for Securing Software Update Systems The Update Framework TUF is a framework for secure content delivery and updates. It protects against various types of supply chain attacks and provides resilience to compromise. This repository is a reference implementation written in Python. It is...

python-tuf v7.0.1

A Framework for Securing Software Update Systems The Update Framework TUF is a framework for secure content delivery and updates. It protects against various types of supply chain attacks and provides resilience to compromise. This repository is a reference implementation written in Python. It is...

The vulnerability of the Self Update Framework component of the Oracle Enterprise Manager Base Platform allows a perpetrator to gain full control over the application.

The vulnerability of the Self Update Framework component of the Oracle Enterprise Manager Base Platform software is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the application using the HTTPS...

EUVD-2026-46493

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Self Update Framework. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise...

EUVD-2026-46495

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Self Update Framework. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise...

CVE-2026-47006

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Self Update Framework. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise...

CVE-2026-47005

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Self Update Framework. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise...

CVE-2026-47004

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Self Update Framework. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise...

CVE-2026-47121

Sparkle is a software update framework for macOS. Prior to version 2.9.2, Autoupdate/SUBinaryDeltaApply.m enforces relativePath.pathComponents containsObject:@".." and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative...

EUVD-2026-46259

Sparkle is a software update framework for macOS. Prior to version 2.9.2, Autoupdate/SUBinaryDeltaApply.m enforces relativePath.pathComponents containsObject:@".." and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative...

PT-2026-62170

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Self Update Framework. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise...

PT-2026-62169

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Self Update Framework. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise...

PT-2026-62171

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Self Update Framework. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise...

EUVD-2026-25628

awslabs/tough is Missing Delegated Metadata Validation...

Amazon tough 数据伪造问题漏洞

Amazon Tough is a Rust client library for The Update Framework TUF by Amazon Inc. Versions of Amazon Tough prior to v0.22.0 contained a data manipulation vulnerability. This vulnerability stemmed from the lack of expiration, hashing, and length checks in the delegated metadata validation process...

PT-2026-35079

Name of the Vulnerable Software and Affected Versions awslabs/tough versions prior to 0.22.0 Description Improper verification of cryptographic signature uniqueness in delegated role validation allows remote authenticated users to bypass the TUF signature threshold requirement by duplicating a...

Amazon Linux 2023 : runfinch-finch (ALAS2023-2026-1507)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1507 advisory. Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Prior to 1.8.5, Fulcio's metaRegex function uses unanchored regex, allowing attacke...

CVE-2026-34155 RAUC: Improper Signing of Plain Bundles Exceeding 2 GiB

RAUC controls the update process on embedded Linux systems. Prior to version 1.15.2, RAUC bundles using the 'plain' format exceeding a payload size of 2 GiB cause an integer overflow which results in a signature which covers only the first few bytes of the payload. Given such a bundle with a...

CVE-2026-34155 RAUC: Improper Signing of Plain Bundles Exceeding 2 GiB

RAUC controls the update process on embedded Linux systems. Prior to version 1.15.2, RAUC bundles using the 'plain' format exceeding a payload size of 2 GiB cause an integer overflow which results in a signature which covers only the first few bytes of the payload. Given such a bundle with a...

GO-2026-4358 Sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal in github.com/sigstore/sigstore

Sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal in github.com/sigstore/sigstore...