CyberSecBulletin

PackageKit vulnerabilities

We track 2 vulnerabilities in PackageKit products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 9, 2026.

2vulnerabilities
0critical
2high
0exploited
8.7average CVSS score

Latest PackageKit vulnerabilities

  • 8.5 High severity

    PackageKit: Relative Path Traversal

    CVE-2026-104620PackageKit

    A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges.

  • 8.8 High severity

    PackageKit: Time-of-check Time-of-use (TOCTOU) Race Condition

    CVE-2026-41651PackageKit

    PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race