portmaster vulnerabilities

CVEs whose affected-version data names the portmaster package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111664Medium· 4.4

yesterday

Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-url

Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can…

▾ Sunlitsafing · portmastervia CVEORG