616696 matches found
CVE-2026-54575 mport package fetch and clean paths are vulnerable to TOCTOU filesystem races
mport is the MidnightBSD Package Manager. Prior to 2.7.8, privileged package fetch and cache-cleaning operations used race-prone path handling across libmport/fetch.c, libmport/clean.c, libmport/util.c, libmport/bundlereadinstallpkg.c, libmport/deleteprimative.c, and...
CVE-2026-54586 mport permits repository and package mirror fetches over insecure transport
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchindex, mportfetchbootstrapindex, and mportfetchbundle paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a urlishttps enforcement check. When a cleartext URL was configured or returned by...
CVE-2026-54586 mport permits repository and package mirror fetches over insecure transport
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchindex, mportfetchbootstrapindex, and mportfetchbundle paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a urlishttps enforcement check. When a cleartext URL was configured or returned by...
CVE-2026-54586
CVE-2026-54586 affects mport , the MidnightBSD Package Manager . Prior to version 2.7.8 , the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a url_is_https() enforcement check. Wh...
EUVD-2026-82324
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchindex, mportfetchbootstrapindex, and mportfetchbundle paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a urlishttps enforcement check. When a cleartext URL was configured or returned by...
CVE-2026-54586 mport permits repository and package mirror fetches over insecure transport
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchindex, mportfetchbootstrapindex, and mportfetchbundle paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a urlishttps enforcement check. When a cleartext URL was configured or returned by...
CVE-2026-54580 mport index decompression can leave partial or corrupt index data after zstd failures
mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal in mportdecompresszstd, and libmport/fetch.c did not consistently propagate those failures to index-fetch callers. A malicious or faulty mirror could supply...
CVE-2026-54582 mport package installation can overwrite existing unmanaged or differently owned files
mport is the MidnightBSD Package Manager. Prior to 2.7.8, package installation lacked a preflight check for incoming non-directory assets that already existed on disk. The affected logic across libmport/checkpreconditions.c, libmport/installprimative.c, and libmport/mportprivate.h did not apply...
CVE-2026-90137 platform/x86: hp-bioscfg: fix password encoding bounds check
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix password encoding bounds check The password PSWDENCODINGS parser reads passwordobjelem + posvalues while copying the supported password encodings from the ACPI package. The outer loop only guarantees...
CVE-2026-90137
CVE-2026-90137 is an out-of-bounds read in the hp-bioscfg platform driver of the Linux kernel. The PSWD_ENCODINGS parser reads password_obj[elem + pos_values] while copying supported password encodings from an ACPI package, but lacks a bounds check on the computed index. A malformed ACPI package ...
EUVD-2026-81730
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix password encoding bounds check The password PSWDENCODINGS parser reads passwordobjelem + posvalues while copying the supported password encodings from the ACPI package. The outer loop only guarantees...
GO-2026-6444 vulnerabilities
Vulnerabilities for packages: kgateway, kubescape-operator-fips, cg, chaos-mesh-fips, chartmuseum, k9s-fips, helm-exporter-fips, kube-mgmt, zarf, envoy-gateway, zarf-fips, trivy-fips, harvester-fips, neuvector, docker-cli-buildx-fips, helm-operator, buildkitd-fips, kubescape,...
ROOT-OS-DEBIAN-12-CVE-2023-34152 CVE-2023-34152 in imagemagick - Patched by Root
Root has patched CVE-2023-34152 in the imagemagick package for Root:Debian:12. Multiple fixed versions available...
CVE-2026-92951 vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver
vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowliste...
ROOT-APP-NPM-CVE-2026-56876 CVE-2026-56876 in extract-zip - Patched by Root
Root has patched CVE-2026-56876 in the extract-zip package for Root:npm. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2024-1597 CVE-2024-1597 in org.postgresql:postgresql - Patched by Root
Root has patched CVE-2024-1597 in the org.postgresql:postgresql package for Root:Maven. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-53550 CVE-2026-53550 in js-yaml - Patched by Root
Root has patched CVE-2026-53550 in the js-yaml package for Root:npm. Multiple fixed versions available...
ROOT-APP-GOBINARY-CVE-2026-71309 CVE-2026-71309 in github.com/rclone/rclone - Patched by Root
Root has patched CVE-2026-71309 in the github.com/rclone/rclone package for Root:Go. Multiple fixed versions available...