Known vulnerabilities in tough

Software: tough
Software CPE: cpe:2.3:a:amazon_web_services:tough:*:*:*:*:*:the_update_framework_tuf:*:*
Total vulnerabilities: 12
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting tough tough is affected by 12 known vulnerabilities: 1 high, 1 medium, 10 low Critical High Medium Low

Vulnerabilities (12)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU127901 - Improper Verification of Cryptographic Signature
CVE-2026-6966
CWE-347 Low
No
No
0.22.0 25.04.2026 SB20260425204
#VU127900 - Insufficient Verification of Data Authenticity
CVE-2026-6967
CWE-345 Low
No
No
0.22.0 25.04.2026 SB20260425204
#VU127899 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-6968
CWE-22 Low
No
No
0.22.0 25.04.2026 SB20260425204
#VU106243 - Improper input validation
CWE-20 Low
No
No
0.20.0 28.03.2025 SB2025032830
#VU106242 - Comparison using wrong factors
CVE-2025-2887
CWE-1025 Low
No
No
0.20.0 28.03.2025 SB2025032830
#VU106241 - Comparison using wrong factors
CVE-2025-2888
CWE-1025 Low
No
No
0.20.0 28.03.2025 SB2025032830
#VU106240 - Always-Incorrect Control Flow Implementation
CVE-2025-2886
CWE-670 Low
No
No
0.20.0 28.03.2025 SB2025032830
#VU106239 - Improper input validation
CVE-2025-2885
CWE-20 Low
No
No
0.20.0 28.03.2025 SB2025032830
#VU127897 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-41150
CWE-22 Low
No
No
0.12.0 19.10.2021 SB2021101988
#VU127896 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-41149
CWE-22 Medium
No
No
0.12.0 19.10.2021 SB2021101988
#VU29694 - Improper Verification of Cryptographic Signature
CVE-2020-6174
CWE-347 High
No
No
0.7.1 13.07.2020 SB2020020522
SB2020071308
#VU127898 - Improper Verification of Cryptographic Signature
CVE-2020-15093
CWE-347 Low
No
No
0.7.1 09.07.2020 SB2020071308