Advisories · Technology

MidnightBSD mport.

Every CVE that names MidnightBSD mport among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-54584 CVE record

CVSS 5.3 Medium

mport trusts environment-controlled temporary directories in privileged metadata extraction
- MidnightBSD mport
- Path traversal
- CWE-377
Not analysed yet 21 Sept 2026
CVE-2026-54579 CVE record

CVSS 2.3 Low

mport mirror-selection ping accepts insufficiently validated ICMP replies
- MidnightBSD mport
- Memory corruption
- CWE-345
Not analysed yet 17 Sept 2026
CVE-2026-54576 CVE record

CVSS 5.8 Medium

mport package installation has symlink TOCTOU in chown and chmod handling
- MidnightBSD mport
- Path traversal
- Race condition
Not analysed yet 17 Sept 2026
CVE-2026-54587 CVE record

CVSS 5.8 Medium

mport directory asset installation is vulnerable to symlink and path traversal races
- MidnightBSD mport
- Path traversal
- Race condition
Not analysed yet 17 Sept 2026
CVE-2026-54575 CVE record

CVSS 5.8 Medium

mport package fetch and clean paths are vulnerable to TOCTOU filesystem races
- MidnightBSD mport
- Command injection
- Race condition
Not analysed yet 17 Sept 2026
CVE-2026-54578 CVE record

CVSS 2.0 Low

mport verify can compare stale checksum data after hashing failures
- MidnightBSD mport
- CWE-354
- CWE-755
Not analysed yet 17 Sept 2026
CVE-2026-54586 CVE record

CVSS 6.0 Medium

mport permits repository and package mirror fetches over insecure transport
- MidnightBSD mport
- Weak cryptography or TLS
- CWE-345
Not analysed yet 17 Sept 2026
CVE-2026-54585 CVE record

CVSS 6.0 Medium

mport sample file handling can write outside the configured root
- MidnightBSD mport
- Path traversal
Not analysed yet 17 Sept 2026
CVE-2026-54580 CVE record

CVSS 8.3 High

mport index decompression can leave partial or corrupt index data after zstd failures
- MidnightBSD mport
- CWE-354
- CWE-755
Not analysed yet 17 Sept 2026
CVE-2026-54582 CVE record

CVSS 6.0 Medium

mport package installation can overwrite existing unmanaged or differently owned files
- MidnightBSD mport
- Path traversal
- Information disclosure
Not analysed yet 17 Sept 2026
CVE-2026-54577 CVE record

CVSS 2.0 Low

mport audit can inspect the wrong package when options are present
- MidnightBSD mport
- CWE-20
- CWE-693
Not analysed yet 17 Sept 2026
CVE-2026-54583 CVE record

CVSS 8.3 High

mport package bundle downloads allow unsafe destination filenames
- MidnightBSD mport
- Path traversal
Not analysed yet 17 Sept 2026
CVE-2026-54581 CVE record

CVSS 8.3 High

mport bootstrap index fetch can continue after hash verification failure
- MidnightBSD mport
- Weak cryptography or TLS
- CWE-345
Not analysed yet 17 Sept 2026