PackageKit

Every one of the 8 is a mark on the map. Named now: 1 to 8, most at risk first.

1. PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as rootCVE-2026-41651PackageKit · CVSS 8.8 · 0.5% likelycovered by CyberSIXT

   CWE-367

2. PackageKit error messages leak presence and mimetype of files to unprivileged usersCVE-2020-16121PackageKit · CVSS 3.3 · 0.5% likely

   CWE-209

3. PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of arbitrary code.CVE-2011-2515packagekit · 0.4% likely

   CWE-732

4. The Zypper (aka zypp) backend in PackageKit before 0.8.8 allows local users to downgrade packages via the "install updates" method.CVE-2013-1764Packagekit Project · 0.4% likely

   CWE-264

5. Packagekit's apt backend lets user install untrusted local packagesCVE-2020-16122PackageKit · CVSS 8.2 · 0.3% likely

   CWE-269

6. A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure the time the methods t…CVE-2022-0987Packagekit Project · 0.3% likely

   CWE-200

7. PackageKit/ZYpp local privilege escalation using InstallFiles(SIMULATE)CVE-2026-104620PackageKit · CVSS 8.5 · 0.2% likely

   CWE-23

8. PackageKit ZYpp rollback vulnerabilityCVE-2026-104619PackageKit · CVSS 7.8 · 0.1% likely

   CWE-1328

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.