{"items":[{"id":"CVE-2026-24686","published":"2026-01-27T00:45:43.422Z","updated":"2026-01-27T14:40:01.511Z","title":"go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names","severity":"MEDIUM","score":4.7,"vendor":"theupdateframework","product":"go-tuf","kev":false,"epss":0.00231,"kevAdded":null,"exploit":true},{"id":"CVE-2026-23992","published":"2026-01-22T02:20:06.845Z","updated":"2026-01-22T15:21:21.301Z","title":"go-tuf improperly validates the configured threshold for delegations","severity":"MEDIUM","score":5.9,"vendor":"theupdateframework","product":"go-tuf","kev":false,"epss":0.00215,"kevAdded":null,"exploit":false},{"id":"CVE-2026-23991","published":"2026-01-22T02:16:37.294Z","updated":"2026-01-22T15:35:31.770Z","title":"go-tuf affected by client DoS via malformed server response","severity":"MEDIUM","score":5.9,"vendor":"theupdateframework","product":"go-tuf","kev":false,"epss":0.00581,"kevAdded":null,"exploit":false},{"id":"CVE-2024-47534","published":"2024-10-01T15:17:47.363Z","updated":"2024-11-21T16:56:38.062Z","title":"Incorrect delegation lookups can make go-tuf download the wrong artifact","severity":"HIGH","score":8.2,"vendor":"theupdateframework","product":"go-tuf","kev":false,"epss":0.00507,"kevAdded":null,"exploit":false},{"id":"CVE-2022-29173","published":"2022-05-05T22:30:12.000Z","updated":"2025-04-23T18:31:00.276Z","title":"No protection against rollback attacks in go-tuf","severity":"HIGH","score":8,"vendor":"theupdateframework","product":"go-tuf","kev":false,"epss":0.0057,"kevAdded":null,"exploit":false},{"id":"CVE-2021-41131","published":"2021-10-19T17:50:11.000Z","updated":"2024-11-18T22:45:18.899Z","title":"Client metadata path-traversal in python-tuf","severity":"HIGH","score":7.5,"vendor":"theupdateframework","product":"python-tuf","kev":false,"epss":0.0145,"kevAdded":null,"exploit":false},{"id":"CVE-2020-15163","published":"2020-09-09T17:30:19.000Z","updated":"2024-08-04T13:08:22.456Z","title":"Invalid root may become trusted root in The Update Framework (TUF)","severity":"HIGH","score":8.7,"vendor":"theupdateframework","product":"tuf","kev":false,"epss":0.0067,"kevAdded":null,"exploit":false}]}