Vulnerabilities

TI-2026-39419 CVE-2026-54584

mport trusts environment-controlled temporary directories in privileged metadata extraction

LOW 24

mport is the MidnightBSD Package Manager.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00466 Published 2026-09-21 Fixed in 2.7.8 CWE-377

TI-2026-39414 CVE-2026-54579

mport mirror-selection ping accepts insufficiently validated ICMP replies

LOW 11

mport is the MidnightBSD Package Manager.

CVSS 4.0LOW 2.3 Adjacent network No auth No interaction EPSS 0.00159 Published 2026-09-17 Fixed in 2.7.8 CWE-125

TI-2026-39411 CVE-2026-54576

mport package installation has symlink TOCTOU in chown and chmod handling

LOW 25

mport is the MidnightBSD Package Manager.

CVSS 4.0MEDIUM 5.8 Local Low privileges No interaction EPSS 0.00105 Published 2026-09-17 Fixed in 2.7.8 CWE-367

TI-2026-39422 CVE-2026-54587

mport directory asset installation is vulnerable to symlink and path traversal races

LOW 25

mport is the MidnightBSD Package Manager.

CVSS 4.0MEDIUM 5.8 Local Low privileges No interaction EPSS 0.00105 Published 2026-09-17 Fixed in 2.7.8 CWE-367

TI-2026-39410 CVE-2026-54575

mport package fetch and clean paths are vulnerable to TOCTOU filesystem races

LOW 27

mport is the MidnightBSD Package Manager.

CVSS 4.0MEDIUM 5.8 Local Low privileges No interaction EPSS 0.00122 Published 2026-09-17 Fixed in 2.7.8 CWE-367

TI-2026-39413 CVE-2026-54578

mport verify can compare stale checksum data after hashing failures

LOW 10

mport is the MidnightBSD Package Manager.

CVSS 4.0LOW 2.0 Local Low privileges No interaction EPSS 0.00113 Published 2026-09-17 Fixed in 2.7.8 CWE-354

TI-2026-39421 CVE-2026-54586

mport permits repository and package mirror fetches over insecure transport

LOW 32

mport is the MidnightBSD Package Manager.

CVSS 4.0MEDIUM 6.0 Adjacent network No auth No interaction EPSS 0.00154 Published 2026-09-17 Fixed in 2.7.8 CWE-319

TI-2026-39420 CVE-2026-54585

mport sample file handling can write outside the configured root

LOW 28

mport is the MidnightBSD Package Manager.

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.00544 Published 2026-09-17 Fixed in 2.7.8 CWE-22

TI-2026-39415 CVE-2026-54580

mport index decompression can leave partial or corrupt index data after zstd failures

LOW 36

mport is the MidnightBSD Package Manager.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00261 Published 2026-09-17 Fixed in 2.7.8 CWE-354

TI-2026-39417 CVE-2026-54582

mport package installation can overwrite existing unmanaged or differently owned files

LOW 28

mport is the MidnightBSD Package Manager.

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.00554 Published 2026-09-17 Fixed in 2.7.8 CWE-668

TI-2026-39412 CVE-2026-54577

mport audit can inspect the wrong package when options are present

LOW 10

mport is the MidnightBSD Package Manager.

CVSS 4.0LOW 2.0 Local Low privileges No interaction EPSS 0.0016 Published 2026-09-17 Fixed in 2.7.8 CWE-20

TI-2026-39418 CVE-2026-54583

mport package bundle downloads allow unsafe destination filenames

LOW 37

mport is the MidnightBSD Package Manager.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.0054 Published 2026-09-17 Fixed in 2.7.8 CWE-22

TI-2026-39416 CVE-2026-54581

mport bootstrap index fetch can continue after hash verification failure

LOW 35

mport is the MidnightBSD Package Manager.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00218 Published 2026-09-17 Fixed in 2.7.8 CWE-345

TI-2020-14926 CVE-2020-24385 · GHSA-p9x8-8fhr-66mg

In MidnightBSD before 1.2.6 and 1.3 before August 2020, and FreeBSD before 7, a NULL…

LOW 25

In MidnightBSD before 1.2.6 and 1.3 before August 2020, and FreeBSD before 7, a NULL pointer dereference was found in the Linux emulation layer that allows attackers to crash the running kernel.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00367 Published 2020-09-03 No fix listed CWE-476

TI-2020-15220 CVE-2020-24863 · GHSA-qjw3-35px-c96q

A memory corruption vulnerability was found in the kernel function kern_getfsstat in…

LOW 26

A memory corruption vulnerability was found in the kernel function kern_getfsstat in MidnightBSD before 1.2.7 and 1.3 through 2020-08-19, and FreeBSD through 11.4, that allows an attacker to trigger an invalid free and c…

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00533 Published 2020-09-03 No fix listed CWE-787

TI-2009-00656 CVE-2009-0687 · GHSA-r7qv-r86r-qrqf

The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through…

MEDIUM 46

The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirOS 10 and earlier, and MidnightBSD 0.3-current allows remote attackers to cause a denial of service (…

CVSS 2.0HIGH 7.8 Network No auth Interaction — EPSS 0.09523 Published 2009-08-11 No fix listed CWE-399

TI-2008-04392 CVE-2008-4609 · GHSA-vf4j-pjcc-qf79

The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft…

MEDIUM 56

The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue…

CVSS 2.0HIGH 7.1 Network No auth Interaction — EPSS 0.32353 Published 2008-10-20 No fix listed CWE-16

TI-2006-05781 CVE-2006-6013 · GHSA-6jjw-8xq9-mjfm

Integer signedness error in the fw_ioctl (FW_IOCTL) function in the FireWire (IEEE-1394)…

LOW 12

Integer signedness error in the fw_ioctl (FW_IOCTL) function in the FireWire (IEEE-1394) drivers (dev/firewire/fwdev.c) in various BSD kernels, including DragonFlyBSD, FreeBSD 5.5, MidnightBSD 0.1-CURRENT before 20061115…

CVSS 2.0LOW 2.1 Local No auth Interaction — EPSS 0.00421 Published 2006-11-21 No fix listed

Vulnerabilities

Filters