Every CVE whose affected-product data names Amazon Tough, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (10)
CVE-2020-15093 — CVSS 8.6 (high): The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an…
CVE-2021-41149 — CVSS 8.2 (high): Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior…
CVE-2021-41150 — CVSS 8.2 (high): Tough provides a set of Rust libraries and tools for using and generating the update framework (TUF) repositories. The tough library, prior…
CVE-2026-6968 — CVSS 5.9 (medium): Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated users with delegated signing authority to…
CVE-2026-6967 — CVSS 5.9 (medium): Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough before tough-v0.22.0 allows remote…
CVE-2026-6966 — CVSS 5.3 (medium): Improper verification of cryptographic signature uniqueness in delegated role validation in awslabs/tough before tough-v0.22.0 allows…
CVE-2025-2887 — CVSS 4.5 (medium): During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to fetch a target from…
CVE-2025-2888 — CVSS 4.5 (medium): During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform…
CVE-2025-2885 — CVSS 4.5 (medium): Missing validation of the root metatdata version number could allow an actor to supply an arbitrary version number to the client instead of…
CVE-2025-2886 — CVSS 4.5 (medium): Missing validation of terminating delegation causes the client to continue searching the defined delegation list, even after searching a…