CVE-2026-21437
Medium · 5.5CVSS
5.5
EPSS
0.2%
Published
Jan 1, 2026
CISA due date
—
The record
eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could include files that are not tracked by `eopkg`. This requires the installation of a package from a malicious or compromised source. Files in such packages would not be shown by `lseopkg` and related tools. The issue has been fixed in v4.4.0. Users only installing packages from the Solus repositories are not affected.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-89179 WeenyGenius, a computer lab management system by Howyar Technologies, has a Missing… CWE-353
- CVE-2026-58224 A flaw was found in Samba's CTDB, the clustered database service used by Samba. CWE-353
- CVE-2026-17583 The affected Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because… CWE-353
- CVE-2026-48995 pnpm is a package manager. CWE-353
- CVE-2026-7574 Anthropic Claude Desktop Cowork VM image handling (confirmed across v1.1348.0 through… CWE-353
- CVE-2026-45787 electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. CWE-353
- GHSA-g29v-q6h7-76wh electerm's encrypt method not safe enough CWE-353
- CVE-2026-42428 OpenClaw versions before 2026.4.8 fail to enforce integrity verification on downloaded… CWE-353