theupdateframework go-tuf

• CVE-2026-24686 Medium 4.7 go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names 0.2%
• CVE-2026-23992 Medium 5.9 go-tuf improperly validates the configured threshold for delegations 0.2%
• CVE-2026-23991 Medium 5.9 go-tuf affected by client DoS via malformed server response 0.6%
• CVE-2024-47534 High 8.2 Incorrect delegation lookups can make go-tuf download the wrong artifact 0.5%
• CVE-2022-29173 High 8.0 No protection against rollback attacks in go-tuf 0.6%