# MidnightBSD vulnerabilities Source: https://junglewise.ai/threats/vendors/midnightbsd Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/midnightbsd.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 14 vulnerabilities in MidnightBSD: 0 in the last 7 days and 13 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-54584, was published on 21 September 2026. Nothing in the last four weeks, down from 13 vulnerabilities in the four before. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 13 - All time: 14 (0 critical, 0 exploited in the wild) ## About MidnightBSD MidnightBSD is a Unix-like operating system derived from FreeBSD. ## Latest MidnightBSD vulnerabilities - [CVE-2026-54584: mport insecure TMPDIR usage in privileged contexts](https://junglewise.ai/threats/cve-2026-54584-mport-is-the-midnightbsd-package-manager-mport-before-2-7-8-used) (info, published 21 Sep 2026) - [CVE-2026-54587: MidnightBSD mport directory traversal in package installation](https://junglewise.ai/threats/cve-2026-54587-midnightbsd-mport-directory-traversal-in-package-installation) (info, published 17 Sep 2026) - [CVE-2026-54586: MidnightBSD mport HTTP package fetch without HTTPS enforcement](https://junglewise.ai/threats/cve-2026-54586-midnightbsd-mport-http-package-fetch-without-https-enforcement) (info, CVSS 6.5, published 17 Sep 2026) - [CVE-2026-54585: MidnightBSD mport path traversal in sample-file handling](https://junglewise.ai/threats/cve-2026-54585-midnightbsd-mport-path-traversal-in-sample-file-handling) (info, published 17 Sep 2026) - [CVE-2026-54583: MidnightBSD mport path traversal in bundle filename handling](https://junglewise.ai/threats/cve-2026-54583-midnightbsd-mport-path-traversal-in-bundle-filename-handling) (info, published 17 Sep 2026) - [CVE-2026-54582: MidnightBSD mport file conflict check bypass](https://junglewise.ai/threats/cve-2026-54582-midnightbsd-mport-file-conflict-check-bypass) (info, published 17 Sep 2026) - [CVE-2026-54581: MidnightBSD mport hash verification bypass in bootstrap index fetch](https://junglewise.ai/threats/cve-2026-54581-midnightbsd-mport-hash-verification-bypass-in-bootstrap-index) (info, CVSS 6.5, published 17 Sep 2026) - [CVE-2026-54580: MidnightBSD mport zstd decompression error handling failure](https://junglewise.ai/threats/cve-2026-54580-midnightbsd-mport-zstd-decompression-error-handling-failure) (info, published 17 Sep 2026) - [CVE-2026-54579: MidnightBSD mport insufficient ICMP reply validation](https://junglewise.ai/threats/cve-2026-54579-midnightbsd-mport-insufficient-icmp-reply-validation) (info, CVSS 5.9, published 17 Sep 2026) - [CVE-2026-54578: MidnightBSD mport checksum verification bypass](https://junglewise.ai/threats/cve-2026-54578-midnightbsd-mport-checksum-verification-bypass) (info, published 17 Sep 2026) - [CVE-2026-54577: MidnightBSD mport argument handling flaw in audit command](https://junglewise.ai/threats/cve-2026-54577-midnightbsd-mport-argument-handling-flaw-in-audit-command) (info, published 17 Sep 2026) - [CVE-2026-54576: MidnightBSD mport symlink TOCTOU in package installation](https://junglewise.ai/threats/cve-2026-54576-midnightbsd-mport-symlink-toctou-in-package-installation) (info, CVSS 5.5, published 17 Sep 2026) - [CVE-2026-54575: MidnightBSD mport time-of-check/time-of-use in package fetch and cleanup](https://junglewise.ai/threats/cve-2026-54575-midnightbsd-mport-time-of-check-time-of-use-in-package-fetch-and) (info, published 17 Sep 2026) - [CVE-2026-45257: FreeBSD KTLS arbitrary file overwrite via in-place decryption](https://junglewise.ai/threats/cve-2026-45257-freebsd-ktls-arbitrary-file-overwrite-via-in-place-decryption) (info, CVSS 0, published 26 Jun 2026) ## Most severe MidnightBSD vulnerabilities - [CVE-2026-54581: MidnightBSD mport hash verification bypass in bootstrap index fetch](https://junglewise.ai/threats/cve-2026-54581-midnightbsd-mport-hash-verification-bypass-in-bootstrap-index) (info, CVSS 6.5, published 17 Sep 2026) - [CVE-2026-54586: MidnightBSD mport HTTP package fetch without HTTPS enforcement](https://junglewise.ai/threats/cve-2026-54586-midnightbsd-mport-http-package-fetch-without-https-enforcement) (info, CVSS 6.5, published 17 Sep 2026) - [CVE-2026-54579: MidnightBSD mport insufficient ICMP reply validation](https://junglewise.ai/threats/cve-2026-54579-midnightbsd-mport-insufficient-icmp-reply-validation) (info, CVSS 5.9, published 17 Sep 2026) - [CVE-2026-54576: MidnightBSD mport symlink TOCTOU in package installation](https://junglewise.ai/threats/cve-2026-54576-midnightbsd-mport-symlink-toctou-in-package-installation) (info, CVSS 5.5, published 17 Sep 2026) - [CVE-2026-45257: FreeBSD KTLS arbitrary file overwrite via in-place decryption](https://junglewise.ai/threats/cve-2026-45257-freebsd-ktls-arbitrary-file-overwrite-via-in-place-decryption) (info, CVSS 0, published 26 Jun 2026) - [CVE-2026-54582: MidnightBSD mport file conflict check bypass](https://junglewise.ai/threats/cve-2026-54582-midnightbsd-mport-file-conflict-check-bypass) (info, published 17 Sep 2026) - [CVE-2026-54585: MidnightBSD mport path traversal in sample-file handling](https://junglewise.ai/threats/cve-2026-54585-midnightbsd-mport-path-traversal-in-sample-file-handling) (info, published 17 Sep 2026) - [CVE-2026-54583: MidnightBSD mport path traversal in bundle filename handling](https://junglewise.ai/threats/cve-2026-54583-midnightbsd-mport-path-traversal-in-bundle-filename-handling) (info, published 17 Sep 2026) - [CVE-2026-54584: mport insecure TMPDIR usage in privileged contexts](https://junglewise.ai/threats/cve-2026-54584-mport-is-the-midnightbsd-package-manager-mport-before-2-7-8-used) (info, published 21 Sep 2026) - [CVE-2026-54580: MidnightBSD mport zstd decompression error handling failure](https://junglewise.ai/threats/cve-2026-54580-midnightbsd-mport-zstd-decompression-error-handling-failure) (info, published 17 Sep 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 13 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 12 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## MidnightBSD technologies - [MidnightBSD Mport](https://junglewise.ai/threats/technologies/mport): 13 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "MidnightBSD vulnerabilities", https://junglewise.ai/threats/vendors/midnightbsd, 9 November 2026.