safing vulnerabilities

Products

• safing/portmaster 1

Latest safing CVEs

Newest publication first

1. CVE-2026-111664 Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-url

   Published 2026-10-16

   Medium·CVSS 4.8 EPSS 0.12%

   Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL th...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.