PackageKit

Records8All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

PackageKit records in CISA KEV

No PackageKit vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Packagekit 8 records MEDIUM

Records

8 records in Packagekit · all components

TI-2026-30170 CVE-2026-41651

PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root

MEDIUM 41

PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00546 Published 2026-04-22 Fixed CWE-367

TI-2020-12681 CVE-2020-16122 · GHSA-jfj4-x686-g8vv

Packagekit's apt backend lets user install untrusted local packages

LOW 36

PackageKit's apt backend mistakenly treated all local debs as trusted.

CVSS 3.1HIGH 8.2 Local Low privileges User interaction EPSS 0.00339 Published 2020-11-07 Fixed in 1.1.13-2ubuntu1.1, 1.1.9-1ubuntu2.18.04.6 +1 CWE-269

TI-2018-01024 CVE-2018-1106 · GHSA-9pvg-w7xf-pgq7

Improper authentication in Red Hat PackageKit

LOW 25

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages.

CVSS 3.0MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00379 Published 2018-04-23 Fixed in 1.1.10 CWE-287

TI-2011-02207 CVE-2011-2515 · GHSA-wvrq-v7hr-q8xr

Incorrect permission assignment in packagekit

LOW 24

PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of arbitrary code.

CVSS 3.1MEDIUM 5.3 Local Low privileges No interaction EPSS 0.00393 Published 2019-11-27 Will not fix CWE-732

TI-2022-00886 CVE-2022-0987 · GHSA-cxr3-mmp5-f58q

Information disclosure in PackageKit

LOW 16

A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00263 Published 2022-06-28 No fix listed CWE-200

TI-2020-12680 CVE-2020-16121 · GHSA-6g23-6jw5-9vrf

PackageKit error messages leak presence and mimetype of files to unprivileged users

LOW 16

PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00468 Published 2020-11-07 Partial fix · 1.1.13-2ubuntu1.1, 1.1.9-1ubuntu2.18.04.6 +1 CWE-209

TI-2024-00195 CVE-2024-0217 · GHSA-g3jm-7w7w-rf6f

Packagekitd: use-after-free in idle function callback

LOW 15

A use-after-free flaw was found in PackageKitd.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00226 Published 2024-01-03 Partial fix · 1.2.7 CWE-416

TI-2013-01551 CVE-2013-1764 · GHSA-9g9q-8hww-wvfx

The Zypper (aka zypp) backend in PackageKit before 0.8.8 allows local users to downgrade…

LOW 11

The Zypper (aka zypp) backend in PackageKit before 0.8.8 allows local users to downgrade packages via the "install updates" method.

CVSS 2.0LOW 2.1 Local No auth Interaction — EPSS 0.00382 Published 2014-04-16 No fix listed CWE-264

Open these records in search →

Critical	0
High	2
Medium	2
Low	4
No CVSS	0