https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 17:03:38 +0000 https://db.gcve.eu/vuln/cve-2026-95624 <p><strong>Affected:</strong> tauri-plugin-updater</p> <p>The Tauri updater plugin&#39;s &#39;check&#39; IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from &#34;update must be newer&#34; to &#34;update must be different.&#34; Because the default permission set grants allow-check to the webview, any XSS in the app frontend can invoke this command and bypass the only anti-rollback protection the updater offers. Combined with another bug, this enables downgrade attacks without even needing to fake a higher version number.</p> <p><strong>Affected:</strong> tauri-plugin-updater</p> <p>The Tauri updater plugin&#39;s &#39;check&#39; IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from &#34;update must be newer&#34; to &#34;update must be different.&#34; Because the default permission set grants allow-check to the webview, any XSS in the app frontend can invoke this command and bypass the only anti-rollback protection the updater offers. Combined with another bug, this enables downgrade attacks without even needing to fake a higher version number.</p> https://db.gcve.eu/vuln/cve-2026-95624