Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
Jan 26, 2026go-tuf is a Go implementation of The Update Framework (TUF).CVE-2026-24686 · Other software · theupdateframework · reported by GitHubMedium 4.7
go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (`repoName`) as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map file from an untrusted source, an attacker can supply a `repoName` containing traversal (e.g., `../escaped-repo`) and cause go-tuf to create directories and write the root metadata file outside the intended `LocalMetadataDir` cache base, within the running process's filesystem permissions. Version 2.4.1 contains a patch.
- Product
- go-tuf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026go-tuf is a Go implementation of The Update Framework (TUF).CVE-2026-23992 · Other software · theupdateframework · reported by GitHubMedium 5.9
go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.
- Product
- go-tuf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026go-tuf is a Go implementation of The Update Framework (TUF).CVE-2026-23991 · Other software · theupdateframework · reported by GitHubMedium 5.9
go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.
- Product
- go-tuf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2024go-tuf is a Go implementation of The Update Framework (TUF).CVE-2024-47534 · Other software · theupdateframework · reported by GitHubHigh 8.2
go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly trace the delegations "B"->"C"->"A". This vulnerability is fixed in 2.0.1.
- Product
- go-tuf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022go-tuf is a Go implementation of The Update Framework (TUF).CVE-2022-29173 · Other software · theupdateframework · reported by GitHubHigh 8
go-tuf is a Go implementation of The Update Framework (TUF). go-tuf does not correctly implement the client workflow for updating the metadata files for roles other than the root role. Specifically, checks for rollback attacks are not implemented correctly meaning an attacker can cause clients to install software that is older than the software which the client previously knew to be available, and may include software with known vulnerabilities. In more detail, the client code of go-tuf has several issues in regards to preventing rollback attacks: 1. It does not take into account the content of any previously trusted metadata, if available, before proceeding with updating roles other than the root role (i.e., steps 5.4.3.1 and 5.5.5 of the detailed client workflow). This means that any form of version verification done on the newly-downloaded metadata is made using the default value of zero, which always passes. 2. For both timestamp and snapshot roles, go-tuf saves these metadata files as trusted before verifying if the version of the metafiles they refer to is correct (i.e., steps 5.5.4 and 5.6.4 of the detailed client workflow). A fix is available in version 0.3.0 or newer. No w
- Product
- go-tuf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2021Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories.CVE-2021-41150 · Other software · awslabs · reported by GitHubHigh 8.2
Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is cached or loaded, files ending with the .json extension could be overwritten with role metadata anywhere on the system. A fix is available in version 0.12.0. No workarounds to this issue are known.
- Product
- tough
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2021Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories.CVE-2021-41149 · Other software · awslabs · reported by GitHubHigh 8.2
Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an output directory. When targets are cached or saved, files could be overwritten with arbitrary content anywhere on the system. A fix is available in version 0.12.0. No workarounds to this issue are known.
- Product
- tough
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2021python-tuf is a Python reference implementation of The Update Framework (TUF).CVE-2021-41131 · Other software · theupdateframework · reported by GitHubHigh 7.5
python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (`tuf/client` and `tuf/ngclient`), there is a path traversal vulnerability that in the worst case can overwrite files ending in `.json` anywhere on the client system on a call to `get_one_valid_targetinfo()`. It occurs because the rolename is used to form the filename, and may contain path traversal characters (ie `../../name.json`). The impact is mitigated by a few facts: It only affects implementations that allow arbitrary rolename selection for delegated targets metadata, The attack requires the ability to A) insert new metadata for the path-traversing role and B) get the role delegated by an existing targets metadata, The written file content is heavily restricted since it needs to be a valid, signed targets file. The file extension is always .json. A fix is available in version 0.19 or newer. There are no workarounds that do not require code changes. Clients can restrict the allowed character set for rolenames, or they can store metadata in files named in a way that is not vulnerable: neither of these approaches is possible without modifying python-tuf.
- Product
- python-tuf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2020Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failedCVE-2020-15163 · Other software · theupdateframework · reported by GitHubHigh 8.7
Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a person-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates. This is fixed in version 0.12 and newer.
- Product
- tuf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2020TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.CVE-2020-6174 · Computers, phones & browsers · Linuxfoundation · reported by MITRECritical 9.8
TUF (aka The Update Framework) through 0.12.1 has Improper Verification of a Cryptographic Signature.
- Product
- The Update Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2020TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.CVE-2020-6173 · Computers, phones & browsers · Linuxfoundation · reported by MITREMedium 5.3
TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.
- Product
- The Update Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.