MidnightBSD mport vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Latest MidnightBSD mport vulnerabilities

CVE-2026-54584 — mport trusts environment-controlled temporary directories in privileged metadata extraction (CVSS 5.3)
CVE-2026-54587 — mport directory asset installation is vulnerable to symlink and path traversal races (CVSS 5.8)
CVE-2026-54586 — mport permits repository and package mirror fetches over insecure transport (CVSS 6.0)
CVE-2026-54585 — mport sample file handling can write outside the configured root (CVSS 6.0)
CVE-2026-54583 — mport package bundle downloads allow unsafe destination filenames (CVSS 8.3)
CVE-2026-54582 — mport package installation can overwrite existing unmanaged or differently owned files (CVSS 6.0)
CVE-2026-54581 — mport bootstrap index fetch can continue after hash verification failure (CVSS 8.3)
CVE-2026-54580 — mport index decompression can leave partial or corrupt index data after zstd failures (CVSS 8.3)
CVE-2026-54579 — mport mirror-selection ping accepts insufficiently validated ICMP replies (CVSS 2.3)
CVE-2026-54578 — mport verify can compare stale checksum data after hashing failures (CVSS 2.0)
CVE-2026-54577 — mport audit can inspect the wrong package when options are present (CVSS 2.0)
CVE-2026-54576 — mport package installation has symlink TOCTOU in chown and chmod handling (CVSS 5.8)
CVE-2026-54575 — mport package fetch and clean paths are vulnerable to TOCTOU filesystem races (CVSS 5.8)