https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-5834.htmlhttps://patchthecve.com/cve/CVE-2023-5834.htmlWed, 17 Jun 2026 06:49:28 +0000LOW 3.8: HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized file system writes. Fixed in Vagrant 2.4.0.https://patchthecve.com/cve/CVE-2022-42717.htmlhttps://patchthecve.com/cve/CVE-2022-42717.htmlWed, 17 Jun 2026 05:05:10 +0000HIGH 7.8: An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrarhttps://patchthecve.com/cve/CVE-2021-21361.htmlhttps://patchthecve.com/cve/CVE-2021-21361.htmlWed, 17 Jun 2026 03:35:23 +0000MEDIUM 5.3: The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. This is fixedhttps://patchthecve.com/cve/CVE-2017-16777.htmlhttps://patchthecve.com/cve/CVE-2017-16777.htmlWed, 17 Jun 2026 01:09:54 +0000HIGH 7.8: If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is not, a local attacker can create a fake application directory and exploit the suid sudo helper in order to escalate to root.https://patchthecve.com/cve/CVE-2017-16001.htmlhttps://patchthecve.com/cve/CVE-2017-16001.htmlWed, 17 Jun 2026 01:08:37 +0000HIGH 7.8: In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently subvert the plugin update process in order to escalate to root privileges.