OpenSUSE

Products

Exploited and recent CVEs

• CVE-2026-104618 Medium 6.2 sdbootutil: world-readable debug log 0.1%
• CVE-2026-104617 Medium 5.1 sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/<pid>/cmdline 0.1%
• CVE-2026-48863 High 7.5 Libsolv: stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service 0.8%
• CVE-2026-56004 Critical 10.0 obs-service-tar_scm: command injection via mercurial handler 0.7%
• CVE-2026-25701 High 7.0 An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects like: * gain access to possible private information found in 0.1%
• CVE-2025-53881 Medium 6.9 SUSE-specific logrotate configuration allows escalation from mail user/group to root 0.2%
• CVE-2025-46810 High 8.5 A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate to root. This issue affects Tumbleweed: from ? before 2.11.2 0.2%
• CVE-2024-49505 Medium 5.3 XSS vulnerability found in OpenSuse MirrorCache 0.4%
• CVE-2024-49506 High 7.3 Fixed temporary file path in aeon-checks allows fixing of disk encryption key <0.1%
• CVE-2023-32184 High 7.8 A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user that runs opensuse-welcome if a custom layout is chosen This i 0.3%
• CVE-2023-32183 High 7.8 Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 package allows users with access to the hacluster to escalate to root This issue affects openSUSE Tumbleweed. 0.2%
• CVE-2023-22652 Low 3.3 Stack buffer overflow in "read_file" function 0.6%
• CVE-2023-32181 Low 3.3 Stack buffer overflow in "econf_writeFile" function 0.6%
• CVE-2022-45153 High 7.0 saphanabootstrap-formula: Escalation to root for arbitrary users in hana/ha_cluster.sls 0.2%
• CVE-2022-31254 High 7.8 rmt-server-pubcloud allows to escalate from user _rmt to root 0.2%
• CVE-2022-21948 Medium 4.3 paste: XSS on the image upload function 0.5%
• CVE-2023-22643 Medium 6.3 libzypp-plugin-appdata: potential arbitrary code execution via shell injection due to `os.system` calls 2.4%
• CVE-2022-31254 High 7.8 rmt-server-pubcloud allows to escalate from user _rmt to root 0.2%
• CVE-2022-46163 High 7.5 travel-support-program vulnerable to data exfiltration via Ransack query injection 1.0%
• CVE-2022-31253 High 7.1 openldap2: /usr/lib/openldap/start allows ldap user/group to recursively chown arbitrary directory trees to itself 0.3%
• CVE-2022-31252 Medium 4.4 permissions: chkstat does not check for group-writable parent directories or target files in safeOpen() 0.1%
• CVE-2022-31252 Medium 4.4 permissions: chkstat does not check for group-writable parent directories or target files in safeOpen() 0.1%
• CVE-2022-31252 Medium 4.4 permissions: chkstat does not check for group-writable parent directories or target files in safeOpen() 0.1%
• CVE-2022-21950 Medium 5.3 canna: unsafe handling of /tmp/.iroha_unix directory 0.2%
• CVE-2022-21950 Medium 5.3 canna: unsafe handling of /tmp/.iroha_unix directory 0.2%
• CVE-2022-31250 High 7.1 keylime %post scriplet allows for privilege escalation from keylime user to root 0.3%
• CVE-2022-21946 Medium 5.3 suddoers configuration for cscreen not restrictive enough 0.3%
• CVE-2022-21945 Medium 5.1 cscreen: usage of fixed path /tmp/cscreen.debug 0.2%
• CVE-2021-36777 High 8.1 login-proxy sends password to attacker-provided domain 0.9%
• CVE-2022-21944 High 7.8 watchman: chown in watchman@.socket unit allows symlink attack 0.3%