safing CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM safing CVE published 2026-10-16

CVE-2026-111664

A vulnerability in Safing Portmaster before 2.2.5 allows unprivileged local processes to force updates via the /api/v1/updates/from-url endpoint. This could potentially lead to the installation of older, vulnerable versions. The vulnerability is caused by the endpoint being registered with api.PermitAnyone, allowing attackers to supply an attacker-controlled index URL that bypasses version checks and auto [truncated]