https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-24686.htmlhttps://patchthecve.com/cve/CVE-2026-24686.htmlWed, 17 Jun 2026 10:23:25 +0000MEDIUM 4.7: go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (`repoName`) as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an applicationhttps://patchthecve.com/cve/CVE-2026-23992.htmlhttps://patchthecve.com/cve/CVE-2026-23992.htmlWed, 17 Jun 2026 10:22:26 +0000MEDIUM 5.9: go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthohttps://patchthecve.com/cve/CVE-2026-23991.htmlhttps://patchthecve.com/cve/CVE-2026-23991.htmlWed, 17 Jun 2026 10:22:26 +0000MEDIUM 5.9: go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of