Skip to content
OpenAdvisories

Package · Debian

packagekit

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.1
    CVE-2026-19816

    PackageKit: dnf5 backend ignores SIMULATE on RepoRemove

    A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard…

    Red Hat Fedora Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian
  • High 8.8
    CVE-2026-41651 Public exploit

    PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root

    PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) rac…

    PackageKit PackageKit packagekit packagekit Debian Ubuntu
  • High 8.2
    CVE-2020-16122

    Packagekit's apt backend lets user install untrusted local packages

    PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.

    PackageKit PackageKit packagekit packagekit Debian Ubuntu