Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: sbabic Clear all filters
TI-2026-71034 CVE-2026-109399 · GHSA-xf8v-f779-856c

Improper certificate validation in SWUpdate lets forged updates install

Priority MEDIUM 41

SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00207 Published 2026-10-12 No fix listed CWE-295
TI-2025-27505 CVE-2025-41259 · GHSA-pmf3-4g49-qvxm

SWUpdate Untrusted Script Execution via Signed Update TOCTOU

Priority HIGH 67

SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TOCTOU) race condition that allows local unprivileged attackers to escalate privileges to root or install untrusted contents using a signed update.

CVSS 4.0HIGH 7.3 Local Low privileges No interaction EPSS 0.00101 Published 2026-06-03 Fixed in 2026.05 CWE-367