Update Infrastructure
Vendor:
First CVE: Nov 4, 2019 · Active for 6 years
7
Total CVEs
More Total CVEs than 83% of tracked products
1.8
Avg CVEs / Year
Higher CVE frequency than 60% of tracked products
6.7
Avg CVSS
Higher Avg CVSS than 34% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Update Infrastructure over time
Volume of CVEsAvg CVSS Base Score
First CVE
Nov 4, 2019
6 years ago
Most Recent CVE
May 26, 2026
60 days ago
CVE Severity & Scoring
Update Infrastructure7 CVEs
57%
43%
All CVEs352,427 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local3 (42.9%)
Network4 (57.1%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low7 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None4 (57.1%)
Unknown0 (0.0%)
Required3 (42.9%)
Privileges Required
Low2 (28.6%)
High0 (0.0%)
None5 (71.4%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-48864HIGH A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validat | May 26, 2026 | 7.8 | 33 | NO | NO |
CVE-2026-9149MEDIUM A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_ad | May 21, 2026 | 6.5 | 31 | NO | NO |
CVE-2026-9150MEDIUM A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. | May 20, 2026 | 6.5 | 30 | NO | NO |
CVE-2023-50782HIGH A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead t | Feb 5, 2024 | 7.5 | 23 | NO | NO |
CVE-2022-3644MEDIUM The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it a | Oct 25, 2022 | 5.5 | 20 | NO | NO |
CVE-2023-50781HIGH A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confident | Feb 5, 2024 | 7.5 | 19 | NO | NO |
CVE-2013-4518MEDIUM RHUI (Red Hat Update Infrastructure) 2.1.3 has world readable PKI entitlement certificates | Nov 4, 2019 | 5.5 | 19 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (7 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (7 CVEs).
Media Mentions
Signals from CVEs in this product scope (7 CVEs).
Top CNAs Publishing CVEs For Update Infrastructure
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 4 | 5 | 7.2 | 0.6% | 0 | 0 |
| 3.0 | 1 | 5.5 | 0.3% | 0 | 0 |
| 2.1.3 | 1 | 5.5 | 0.3% | 0 | 0 |