Midnightbsd Mport vulnerabilities

• midnightbsd mport mport trusts environment-controlled temporary directories in privileged metadata extraction CVE-2026-54584 5.3 MediumSeptember 21, 2026
• midnightbsd mport mport mirror-selection ping accepts insufficiently validated ICMP replies CVE-2026-54579 2.3 LowSeptember 17, 2026
• midnightbsd mport mport package installation has symlink TOCTOU in chown and chmod handling CVE-2026-54576 5.8 MediumSeptember 17, 2026
• midnightbsd mport mport directory asset installation is vulnerable to symlink and path traversal races CVE-2026-54587 5.8 MediumSeptember 17, 2026
• midnightbsd mport mport package fetch and clean paths are vulnerable to TOCTOU filesystem races CVE-2026-54575 5.8 MediumSeptember 17, 2026
• midnightbsd mport mport verify can compare stale checksum data after hashing failures CVE-2026-54578 2.0 LowSeptember 17, 2026
• midnightbsd mport mport permits repository and package mirror fetches over insecure transport CVE-2026-54586 6.0 MediumSeptember 17, 2026
• midnightbsd mport mport sample file handling can write outside the configured root CVE-2026-54585 6.0 MediumSeptember 17, 2026
• midnightbsd mport mport index decompression can leave partial or corrupt index data after zstd failures CVE-2026-54580 8.3 HighSeptember 17, 2026
• midnightbsd mport mport package installation can overwrite existing unmanaged or differently owned files CVE-2026-54582 6.0 MediumSeptember 17, 2026
• midnightbsd mport mport audit can inspect the wrong package when options are present CVE-2026-54577 2.0 LowSeptember 17, 2026
• midnightbsd mport mport package bundle downloads allow unsafe destination filenames CVE-2026-54583 8.3 HighSeptember 17, 2026
• midnightbsd mport mport bootstrap index fetch can continue after hash verification failure CVE-2026-54581 8.3 HighSeptember 17, 2026