PT-2026-35081

Name of the Vulnerable Software and Affected Versions awslabs/tough versions prior to 0.22.0 Description Incomplete path traversal fixes allow remote authenticated users with delegated signing authority to write files outside intended output directories. This occurs because write paths trust the...

PT-2026-35079

Name of the Vulnerable Software and Affected Versions awslabs/tough versions prior to 0.22.0 Description Improper verification of cryptographic signature uniqueness in delegated role validation allows remote authenticated users to bypass the TUF signature threshold requirement by duplicating a...

tough-kms (>=0.1.0, <=0.5.0), tough-ssm (>=0.1.0, <=0.8.0) +1 more potentially affected by unknown CVE via tough (>=0.1.0, <=0.13.0)

tough CARGO version =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.9.0 Source cves: unknown CVE Source advisory: OSV:GHSA-J8X2-777P-23FC...

tough-kms (>=0.1.0, <=0.5.0), tough-ssm (>=0.1.0, <=0.8.0) +1 more potentially affected by CVE-2025-2886 via tough (>=0.1.0, <=0.13.0)

tough CARGO version =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.9.0 Source cves: CVE-2025-2886 Source advisory: OSV:GHSA-V4WR-J3W6-MXQC...

tough-kms (>=0.1.0, <=0.5.0), tough-ssm (>=0.1.0, <=0.8.0) +1 more potentially affected by CVE-2025-2888 via tough (>=0.1.0, <=0.13.0)

tough CARGO version =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.9.0 Source cves: CVE-2025-2888 Source advisory: OSV:GHSA-76G3-38JV-WXH4...

tough-kms (>=0.1.0, <=0.5.0), tough-ssm (>=0.1.0, <=0.8.0) +1 more potentially affected by CVE-2025-2887 via tough (>=0.1.0, <=0.13.0)

tough CARGO version =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.9.0 Source cves: CVE-2025-2887 Source advisory: OSV:GHSA-Q6R9-R9PW-4CF7...

tough-kms (>=0.1.0, <=0.3.3), tough-ssm (>=0.1.0, <=0.6.3) +1 more potentially affected by CVE-2021-41149 via tough (>=0.1.0, <=0.11.3)

tough CARGO version =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.6.4 Source cves: CVE-2021-41149 Source advisory: OSV:GHSA-X3R5-Q6MJ-M485...

tough-ssm (0.1.0), tuftool (>=0.1.0, <=0.4.0) potentially affected by CVE-2020-15093 via tough (>=0.1.0, <=0.6.0)

tough CARGO version =0.1.0, =0.1.0, =0.4.0 Source cves: CVE-2020-15093 Source advisory: OSV:GHSA-5Q2R-92F9-4M49...

tough-ssm (0.1.0), tuftool (>=0.1.0, <=0.4.0) potentially affected by CVE-2020-15093 +1 more via tough (>=0.1.0, <=0.6.0)

tough CARGO version =0.1.0, =0.1.0, =0.4.0 Source cves: CVE-2020-15093, CVE-2020-6174 Source advisory: OSV:RUSTSEC-2020-0024...