| CVE-2026-6968 |
Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated…
|
5.9
Medium
|
Apr 24, 2026 |
| CVE-2026-6967 |
Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before…
|
5.9
Medium
|
Apr 24, 2026 |
| CVE-2026-6966 |
Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before…
|
5.3
Medium
|
Apr 24, 2026 |
| CVE-2025-2888 |
During a snapshot rollback, the client incorrectly caches the timestamp metadata
|
5.7
Medium
|
Mar 27, 2025 |
| CVE-2025-2887 |
During a target rollback, the client fails to detect the rollback for delegated targets
|
5.7
Medium
|
Mar 27, 2025 |
| CVE-2025-2886 |
Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even…
|
5.7
Medium
|
Mar 27, 2025 |
| CVE-2025-2885 |
Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to…
|
5.7
Medium
|
Mar 27, 2025 |