https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T10:29:49.639254+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-54578 CVE-2026-54578 — mport verify can compare stale checksum data after hashing failures 2026-10-07T10:29:49.654730+00:00

Affected: MidnightBSD mport

mport is the MidnightBSD Package Manager. Prior to 2.7.8, mport_verify_package() in libmport/verify.c could continue after MD5File() or SHA256_File() failed and compare an expected checksum with stale data in the hash buffer rather than a newly computed digest. An attacker able to influence an installed file or the conditions that make hashing fail could receive a misleading integrity result or hide a checksum failure. This issue is fixed in version 2.7.8.