Packagekit_project Packagekit
8 CVEs affecting Packagekit_project Packagekit. Latest disclosed: 2026-04-22. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41651 | High | 8.8 | 2026-04-22 | PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit betw… |
CVE-2020-16122 | High | 8.2 | 2020-11-07 | PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individua… |
CVE-2018-1106 | Medium | 5.5 | 2018-04-23 | An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local… |
CVE-2011-2515 | Medium | 5.3 | 2019-11-27 | PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of… |
CVE-2024-0217 | Low | 3.3 | 2024-01-03 | A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memor… |
CVE-2022-0987 | Low | 3.3 | 2022-06-28 | A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure th… |
CVE-2020-16121 | Low | 3.3 | 2020-11-07 | PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be u… |
CVE-2013-1764 | | 2014-04-16 | The Zypper (aka zypp) backend in PackageKit before 0.8.8 allows local users to downgrade packages via the "install updates" method. |