PT-2026-91454

Name of the Vulnerable Software and Affected Versions PackageKit affected versions not specified Description An authorization flaw exists in PackageKit when using the dnf5 backend. The system skips the polkit authorization check for transactions that include the SIMULATE dry-run flag. However, th...

CVE-2026-19816: Incorrect Authorization

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE dry-run flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as role == REPOREMOVE ||...

[SECURITY] Fedora 44 Update: PackageKit-1.4.0-1.fc44

PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distro, cross-architecture API...

[SECURITY] Fedora 45 Update: PackageKit-1.4.0-1.fc45

PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distro, cross-architecture API...

Fedora 44 : PackageKit (2026-6cf9691266)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6cf9691266 advisory. Update to 1.4.0 to fix CVE-2026-19816, GHSA-pwvr-2q5v-xvw4, GHSA-6759-8c43-4xrv, GHSA-6695-qjj5-533m, GHSA-gmhf-fxfx-m2w9 Tenable has extracted the preceding...

Fedora 45 : PackageKit (2026-95d69295a4)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-95d69295a4 advisory. Update to 1.4.0 to fix CVE-2026-19816, GHSA-pwvr-2q5v-xvw4, GHSA-6759-8c43-4xrv, GHSA-6695-qjj5-533m, GHSA-gmhf-fxfx-m2w9 Tenable has extracted the preceding...

SUSE CVE-2026-19816

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE dry-run flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as role == REPOREMOVE ||...

CVE-2026-19816

A flaw was found in PackageKit. In the dnf5 backend, the RepoRemove handler ignores the SIMULATE transaction flag and executes a real package removal, allowing an unprivileged local user to uninstall packages without polkit authorization. Mitigation Red Hat is not aware of a practical temporary...

ROOT-OS-UBUNTU-2004-CVE-2026-41651 CVE-2026-41651 in packagekit - Patched by Root

Root has patched CVE-2026-41651 in the packagekit package for Root:Ubuntu:20.04. Multiple fixed versions available...

K000162968: PackageKit vulnerability CVE-2026-41651

Security Advisory Description PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use TOCTOU race conditio...

Security update for PackageKit

This update for PackageKit fixes the following issues: CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250. Special Instructions and Notes: Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaS...

Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Packagekit_Project Packagekit

CVE-2026-41651 CVSS 3.x : 7.8 HIGH CWE : CWE-367 Ti...

PackageKit-1.3.6-1.1 on GA media (moderate)

PackageKit-1.3.6-1.1 on GA media Announcement ID: openSUSE-SU-2026:11406-1 Rating: moderate Cross-References: CVE-2026-10294 CVSS scores: CVE-2026-10294 SUSE : 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2026-10294 SUSE : 2.1...

Oracle Linux 7 : PackageKit (ELSA-2026-22146)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-22146 advisory. 1.1.10-2.0.3 - Backport fix for CVE-2026-41651 Orabug: 39467887 Tenable has extracted the preceding description block directly from the Oracle Linux security...

SUSE SLES12: PackageKit / PackageKit-backend-zypp / PackageKit-devel / etc (SUSE-SU-2026:3405-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3405-1 advisory. This update for PackageKit fixes the following issue: - CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization...

SUSE SLED15: PackageKit / PackageKit-backend-zypp / PackageKit-devel / etc (SUSE-SU-2026:3404-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3404-1 advisory. - CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250. Tenable h...

PackageKit security update

1.1.10-2.0.3 - Backport fix for CVE-2026-41651 Orabug: 39467887...

Security update for PackageKit

This update for PackageKit fixes the following issue: CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250. Special Instructions and Notes: Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

SUSE-SU-2026:3405-1 Security update for PackageKit

This update for PackageKit fixes the following issue: - CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250...

Security update for PackageKit

This update for PackageKit fixes the following issues: CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250. Special Instructions and Notes: Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaS...