Theupdateframework
7 CVEs across 3 Theupdateframework products. Browse Theupdateframework vulnerabilities, severities, and proof-of-concept exploits.
Theupdateframework products with known CVEs
Theupdateframework CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-24686 | Medium | 4.7 | 2026-01-27 | go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (`repoName`) as a filesys… |
CVE-2026-23992 | Medium | 5.9 | 2026-01-22 | go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repositor… |
CVE-2026-23991 | Medium | 5.9 | 2026-01-22 | go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors… |
CVE-2024-47534 | | | 2024-10-01 | go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A"… |
CVE-2022-29173 | High | 8.0 | 2022-05-05 | go-tuf is a Go implementation of The Update Framework (TUF). go-tuf does not correctly implement the client workflow for updating the metadata files for roles… |
CVE-2021-41131 | High | 7.5 | 2021-10-19 | python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (`tuf/client` and `tuf/ngclient`), there is a path traversal vul… |
CVE-2020-15163 | High | 8.7 | 2020-09-09 | Python TUF (The Update Framework) reference implementation before version 0.12 it will incorrectly trust a previously downloaded root metadata file which faile… |