Skip to content
OpenAdvisories

Vendor

PackageKit

5 known vulnerabilities.

Products

PackageKit 5
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.5
    CVE-2026-104620

    PackageKit/ZYpp local privilege escalation using InstallFiles(SIMULATE)

    A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges.

    PackageKit PackageKit
  • High 8.8
    CVE-2026-41651 Public exploit

    PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root

    PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) rac…

    PackageKit PackageKit packagekit packagekit Debian Ubuntu
  • High 8.2
    CVE-2020-16122

    Packagekit's apt backend lets user install untrusted local packages

    PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.

    PackageKit PackageKit packagekit packagekit Debian Ubuntu