Opensuse
1778 CVEs across 72 Opensuse products. Browse Opensuse vulnerabilities, severities, and proof-of-concept exploits.
Opensuse products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-48863 | High | 7.5 | 2026-07-16 | A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying… |
CVE-2026-44941 | High | 8.4 | 2026-07-02 | A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious reposito… |
CVE-2026-56004 | Critical | 10.0 | 2026-07-02 | A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service fi… |
CVE-2026-25707 | High | 8.8 | 2026-06-29 | A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories t… |
CVE-2026-48864 | High | 7.8 | 2026-05-26 | A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insuf… |
CVE-2026-9149 | Medium | 6.5 | 2026-05-21 | A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size v… |
CVE-2026-9150 | Medium | 6.5 | 2026-05-20 | A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian… |
CVE-2026-31431 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b09… |
CVE-2026-25701 | | 2026-02-25 | An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects like: * gain access… | |
CVE-2026-25506 | High | 7.7 | 2026-02-10 | MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability… |
CVE-2025-62875 | Medium | 5.5 | 2025-11-20 | An Improper Check for Unusual or Exceptional Conditions vulnerability in OpenSMTPD allows local users to crash OpenSMTPD. This issue affects openSUSE Tumbl… |
CVE-2025-53881 | | 2025-10-02 | A UNIX Symbolic Link (Symlink) Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/group to root.This i… | |
CVE-2025-46810 | | 2025-09-02 | A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate to root. This issue… | |
CVE-2025-32463 | Critical | 9.3 | 2025-06-30 | Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option. |
CVE-2024-49506 | | 2024-11-13 | Insecure creation of temporary files allows local users on systems with non-default configurations to cause denial of service or set the encryption key for a f… | |
CVE-2024-49505 | Medium | 6.1 | 2024-11-13 | A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in openSUSE Tumbleweed MirrorCache allows the execution of… |
CVE-2023-32182 | Medium | 5.9 | 2023-09-19 | A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise… |
CVE-2023-32184 | High | 7.8 | 2023-09-19 | A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user that runs opensuse-we… |
CVE-2023-32183 | High | 7.8 | 2023-07-07 | Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 package allows users with access to the hacluster to escalate to root This issue a… |
CVE-2023-32181 | Low | 3.3 | 2023-06-01 | A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files Th… |
CVE-2023-22652 | Low | 3.3 | 2023-06-01 | A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf leads to DoS via malformed config files. This issue… |
CVE-2022-45154 | Medium | 4.4 | 2023-02-15 | A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Ent… |
CVE-2022-45153 | High | 7.0 | 2023-02-15 | An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise S… |
CVE-2022-21948 | Medium | 4.3 | 2023-02-07 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in paste allows remote attackers to place Javascript into… |
CVE-2023-22643 | Medium | 6.3 | 2023-02-07 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in libzypp-plugin-appdata of SUSE Linux Enterprise… |
CVE-2022-31254 | High | 7.8 | 2023-02-07 | A Incorrect Default Permissions vulnerability in rmt-server-regsharing service of SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Server for SAP… |
CVE-2022-46163 | High | 7.5 | 2023-01-10 | Travel support program is a rails app to support the travel support program of openSUSE (TSP). Sensitive user data (bank account details, password Hash) can be… |
CVE-2022-31253 | High | 7.1 | 2022-11-09 | A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arb… |
CVE-2022-31256 | High | 7.7 | 2022-10-26 | A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows lo… |
CVE-2022-31252 | Medium | 4.4 | 2022-10-06 | A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did… |
CVE-2022-28321 | Critical | 9.8 | 2022-09-19 | The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict… |
CVE-2022-31251 | Medium | 6.5 | 2022-09-07 | A Incorrect Default Permissions vulnerability in the packaging of the slurm testsuite of openSUSE Factory allows local attackers with control over the slurm us… |
CVE-2022-21950 | Medium | 5.3 | 2022-09-07 | A Improper Access Control vulnerability in the systemd service of cana in openSUSE Backports SLE-15-SP3, openSUSE Backports SLE-15-SP4 allows local users to hi… |
CVE-2022-31250 | High | 7.1 | 2022-07-20 | A UNIX Symbolic Link (Symlink) Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root. This… |
CVE-2022-21949 | High | 8.8 | 2022-05-03 | A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in cert… |
CVE-2022-21946 | Medium | 5.3 | 2022-03-16 | A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gai… |
CVE-2022-21945 | Medium | 5.1 | 2022-03-16 | A Insecure Temporary File vulnerability in cscreen of openSUSE Factory allows local attackers to cause DoS for cscreen and a system DoS for non-default systems… |
CVE-2021-46705 | Medium | 5.1 | 2022-03-16 | A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attackers to truncate arbit… |
CVE-2021-36777 | High | 8.1 | 2022-03-09 | A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login proxy of the openSUSE Build service allowed attackers to present users with a… |
CVE-2021-44568 | Medium | 6.5 | 2022-02-21 | Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via the resolve_dependencies function at sr… |
CVE-2021-45082 | High | 7.8 | 2022-02-19 | An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules… |
CVE-2022-21944 | High | 7.8 | 2022-01-26 | A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attacker… |
CVE-2021-36781 | Medium | 5.9 | 2022-01-14 | A Incorrect Default Permissions vulnerability in the parsec package of openSUSE Factory allows local attackers to imitate the service leading to DoS or clients… |
CVE-2021-46142 | Medium | 5.5 | 2022-01-06 | An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax. |
CVE-2021-46141 | Medium | 5.5 | 2022-01-06 | An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriFreeUriMembers and uriMakeOwner. |
CVE-2021-41819 | High | 7.5 | 2022-01-01 | CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby. |
CVE-2021-41817 | High | 7.5 | 2022-01-01 | Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3… |
CVE-2021-4166 | High | 7.1 | 2021-12-25 | vim is vulnerable to Out-of-bounds Read |
CVE-2021-33938 | High | 7.5 | 2021-09-02 | Buffer overflow vulnerability in function prune_to_recommended in src/policy.c in libsolv before 0.7.17 allows attackers to cause a Denial of Service. |
CVE-2021-33930 | High | 7.5 | 2021-09-02 | Buffer overflow vulnerability in function pool_installable_whatprovides in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service. |
CVE-2021-33929 | High | 7.5 | 2021-09-02 | Buffer overflow vulnerability in function pool_disabled_solvable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service. |
CVE-2021-33928 | High | 7.5 | 2021-09-02 | Buffer overflow vulnerability in function pool_installable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service. |
CVE-2021-32000 | Low | 3.2 | 2021-07-28 | A UNIX Symbolic Link (Symlink) Following vulnerability in the clone-master-clean-up.sh script of clone-master-clean-up in SUSE Linux Enterprise Server 12 SP3… |
CVE-2020-4675 | Medium | 6.5 | 2021-07-16 | IBM InfoSphere Master Data Management Server 11.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthoriz… |
CVE-2021-25321 | High | 7.8 | 2021-06-30 | A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud C… |
CVE-2019-18906 | Critical | 9.8 | 2021-06-30 | A Improper Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the… |
CVE-2021-31998 | Medium | 6.8 | 2021-06-10 | A Incorrect Default Permissions vulnerability in the packaging of inn of SUSE Linux Enterprise Server 11-SP3; openSUSE Backports SLE-15-SP2, openSUSE Leap 15.2… |
CVE-2021-31997 | Medium | 6.8 | 2021-06-10 | A UNIX Symbolic Link (Symlink) Following vulnerability in python-postorius of openSUSE Leap 15.2, Factory allows local attackers to escalate from users postori… |
CVE-2021-25322 | Medium | 6.8 | 2021-06-10 | A UNIX Symbolic Link (Symlink) Following vulnerability in python-HyperKitty of openSUSE Leap 15.2, Factory allows local attackers to escalate privileges from t… |
CVE-2021-3200 | Low | 3.3 | 2021-05-18 | Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **resultp, int… |
CVE-2021-25317 | Low | 3.3 | 2021-05-05 | A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Clo… |
CVE-2021-25319 | High | 7.8 | 2021-05-05 | A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to… |
CVE-2021-25315 | Critical | 9.8 | 2021-03-03 | CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary c… |
CVE-2020-8032 | Medium | 6.7 | 2021-02-25 | A Insecure Temporary File vulnerability in the packaging of cyrus-sasl of openSUSE Factory allows local attackers to escalate to root. This issue affects: open… |
CVE-2020-8027 | High | 7.3 | 2021-02-11 | A Insecure Temporary File vulnerability in openldap2 of SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, open… |
CVE-2020-8031 | Medium | 6.3 | 2021-02-11 | A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Open Build Service allows remote attackers to store JS… |
CVE-2021-26676 | Medium | 6.5 | 2021-02-09 | gdhcp in ConnMan before 1.39 could be used by network-adjacent attackers to leak sensitive stack information, allowing further exploitation of bugs in gdhcp. |
CVE-2021-26675 | High | 8.8 | 2021-02-09 | A stack-based buffer overflow in dnsproxy in ConnMan before 1.39 could be used by network adjacent attackers to execute code. |
CVE-2020-0569 | Medium | 5.7 | 2020-11-23 | Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated user to potentially enable denial of service via local a… |
CVE-2020-16846 | Critical | 9.8 | 2020-11-06 | An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injectio… |
CVE-2020-28049 | Medium | 6.3 | 2020-11-04 | An issue was discovered in SDDM before 0.19.0. It incorrectly starts the X server in a way that - for a short time period - allows local unprivileged users to… |
CVE-2020-6557 | Medium | 6.5 | 2020-11-03 | Inappropriate implementation in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
CVE-2020-16011 | Critical | 9.6 | 2020-11-03 | Heap buffer overflow in UI in Google Chrome on Windows prior to 86.0.4240.183 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2020-16009 | High | 8.8 | 2020-11-03 | Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2020-16008 | High | 8.8 | 2020-11-03 | Stack buffer overflow in WebRTC in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit stack corruption via a crafted WebRTC… |
CVE-2020-16007 | High | 7.8 | 2020-11-03 | Insufficient data validation in installer in Google Chrome prior to 86.0.4240.183 allowed a local attacker to potentially elevate privilege via a crafted files… |
CVE-2020-16006 | High | 8.8 | 2020-11-03 | Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2020-16005 | High | 8.8 | 2020-11-03 | Insufficient policy enforcement in ANGLE in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2020-16004 | High | 8.8 | 2020-11-03 | Use after free in user interface in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2020-16003 | High | 8.8 | 2020-11-03 | Use after free in printing in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-16002 | High | 8.8 | 2020-11-03 | Use after free in PDFium in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2020-16001 | High | 8.8 | 2020-11-03 | Use after free in media in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-16000 | High | 8.8 | 2020-11-03 | Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2020-15999 | Critical | 9.6 | 2020-11-03 | Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2020-15992 | High | 8.8 | 2020-11-03 | Insufficient policy enforcement in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to bypa… |
CVE-2020-15991 | High | 8.8 | 2020-11-03 | Use after free in password manager in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially per… |
CVE-2020-15990 | High | 8.8 | 2020-11-03 | Use after free in autofill in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2020-15989 | Medium | 5.5 | 2020-11-03 | Uninitialized data in PDFium in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory v… |
CVE-2020-15988 | Medium | 6.3 | 2020-11-03 | Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 86.0.4240.75 allowed a remote attacker who convinced the user to open files t… |
CVE-2020-15987 | High | 8.8 | 2020-11-03 | Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted WebRTC stream. |
CVE-2020-15986 | Medium | 6.5 | 2020-11-03 | Integer overflow in media in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-15985 | Medium | 6.5 | 2020-11-03 | Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to spoof security UI via a crafted HTML page. |
CVE-2020-15984 | Medium | 6.5 | 2020-11-03 | Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 86.0.4240.75 allowed a remote attacker to spoof the contents of the Omnibox (URL ba… |
CVE-2020-15983 | High | 7.8 | 2020-11-03 | Insufficient data validation in webUI in Google Chrome on ChromeOS prior to 86.0.4240.75 allowed a local attacker to bypass content security policy via a craft… |
CVE-2020-15982 | Medium | 6.5 | 2020-11-03 | Inappropriate implementation in cache in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process… |
CVE-2020-15981 | Medium | 6.5 | 2020-11-03 | Out of bounds read in audio in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory vi… |
CVE-2020-15980 | High | 7.8 | 2020-11-03 | Insufficient policy enforcement in Intents in Google Chrome on Android prior to 86.0.4240.75 allowed a local attacker to bypass navigation restrictions via cra… |
CVE-2020-15979 | High | 8.8 | 2020-11-03 | Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2020-15978 | High | 8.8 | 2020-11-03 | Insufficient data validation in navigation in Google Chrome on Android prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process… |
CVE-2020-15977 | Medium | 6.5 | 2020-11-03 | Insufficient data validation in dialogs in Google Chrome on OS X prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information fr… |