Suse
1175 CVEs across 301 Suse products. Browse Suse vulnerabilities, severities, and proof-of-concept exploits.
Suse products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-44945 | Critical | 9.1 | 2026-08-05 | A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the de… |
CVE-2026-25703 | High | 7.3 | 2026-08-05 | NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive… |
CVE-2026-59675 | High | 7.5 | 2026-08-05 | When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the… |
CVE-2026-55998 | Medium | 5.3 | 2026-08-05 | The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that ha… |
CVE-2026-55996 | Medium | 4.3 | 2026-08-05 | A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the cattle-cluster-agent component running in downstream clusters a… |
CVE-2025-8412 | | 2026-07-14 | A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in SUSE Virtual Machine Driver Pack allows an attacker with the ability… | |
CVE-2026-59674 | | 2026-07-14 | A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user to escalate to root. This issue a… | |
CVE-2026-44938 | High | 8.8 | 2026-07-07 | A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleD… |
CVE-2026-44937 | High | 8.2 | 2026-07-06 | Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 an… |
CVE-2026-44936 | Medium | 5.0 | 2026-07-06 | Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14… |
CVE-2026-44934 | | 2026-07-06 | A information disclosure when DEBUG loglevel is set in SUSE Rancher AI Agent 1.0 before 1.0.2 could leak API keys or LLM response text with potential sensitive… | |
CVE-2026-44935 | Critical | 9.9 | 2026-07-02 | Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 befor… |
CVE-2026-44941 | High | 8.4 | 2026-07-02 | A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious reposito… |
CVE-2026-44948 | | 2026-06-30 | A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0… | |
CVE-2026-44949 | | 2026-06-30 | A Rancher FleetWorkspace admission path allowed side effects to occur in the Rancher webhook handler for versions 0.7.0 up to 0.7.10, 0.8.0 up to 0.8.7, 0.9.0… | |
CVE-2026-44947 | | 2026-06-30 | A missing clean-up in the legacy Project Role Template Binding (PRTB) reconciler in Rancher versions 2.13.0 up to 2.13.7 and 2.14.0 up to 2.14.3 allowed users… | |
CVE-2026-44946 | High | 7.4 | 2026-06-30 | A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler did not enforce one-time use of SAML assertion, potentially… |
CVE-2026-41053 | High | 8.8 | 2026-06-30 | Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any log… |
CVE-2026-41052 | High | 8.8 | 2026-06-29 | Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6… |
CVE-2026-25707 | High | 8.8 | 2026-06-29 | A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories t… |
CVE-2026-44939 | | 2026-06-19 | A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/import/{token}_{clusterId}.yaml through unsanitized YAML pa… | |
CVE-2026-44942 | Medium | 6.5 | 2026-06-18 | A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by a… |
CVE-2026-44932 | High | 8.8 | 2026-06-16 | Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server… |
CVE-2025-71261 | High | 8.6 | 2026-06-16 | An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshak… |
CVE-2026-44543 | High | 8.7 | 2026-05-28 | Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to… |
CVE-2026-44933 | High | 7.8 | 2026-05-20 | `PluginScript` attempts to `chroot` the plugin to the `repoManagerRoot`, this root is frequently `/` (the system root) in standard configurations or when using… |
CVE-2026-41054 | High | 7.8 | 2026-05-20 | In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detec… |
CVE-2026-41051 | Medium | 5.0 | 2026-05-13 | csync2 uses insecure temporary directories when compiled with C99 or later, allowing for TOCTOU style attacks on the temporary directories. |
CVE-2026-41050 | Critical | 9.9 | 2026-05-13 | Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repositor… |
CVE-2026-25705 | High | 8.4 | 2026-05-13 | A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicio… |
CVE-2026-31431 | High | 7.8 | 2026-04-22 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b09… |
CVE-2026-25702 | High | 7.3 | 2026-03-05 | A Improper Access Control vulnerability in the kernel of SUSE SUSE Linux Enterprise Server 12 SP5 breaks nftables, causing firewall rules applied via nftables… |
CVE-2025-62879 | Medium | 6.8 | 2026-03-04 | A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both accessKey and secretKey) into the rancher-b… |
CVE-2025-67860 | Low | 3.8 | 2026-02-25 | A vulnerability has been identified in the NeuVector scanner where the scanner process accepts registry and controller credentials as command-line arguments, p… |
CVE-2025-67601 | High | 8.3 | 2026-02-25 | A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the -skip-verify flag to the Rancher CLI login… |
CVE-2025-62878 | Critical | 9.9 | 2026-02-25 | A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensiti… |
CVE-2025-62877 | Critical | 9.8 | 2026-01-08 | Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password if they are using the 1.5.x or 1.6.x interactive i… |
CVE-2025-66001 | High | 8.8 | 2026-01-08 | NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) f… |
CVE-2025-62875 | Medium | 5.5 | 2025-11-20 | An Improper Check for Unusual or Exceptional Conditions vulnerability in OpenSMTPD allows local users to crash OpenSMTPD. This issue affects openSUSE Tumbl… |
CVE-2025-62876 | | 2025-11-12 | A Execution with Unnecessary Privileges vulnerability in lightdm-kde-greeter allows escalation from the service user to root.This issue affects lightdm-kde-gr… | |
CVE-2025-53883 | | 2025-10-30 | A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run arbitrary javascript via a reflected XSS… | |
CVE-2025-53880 | | 2025-10-30 | A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or delete files on the… | |
CVE-2025-54471 | Medium | 6.5 | 2025-10-30 | NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used… |
CVE-2025-54470 | High | 8.6 | 2025-10-30 | This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled. When this option is enabled, NeuVector sends an… |
CVE-2025-54469 | Critical | 9.9 | 2025-10-30 | A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a command to be ex… |
CVE-2024-58269 | Medium | 4.3 | 2025-10-29 | A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and registration tokens, is… |
CVE-2023-32199 | Medium | 4.3 | 2025-10-29 | A vulnerability has been identified within Rancher Manager, where after removing a custom GlobalRole that gives administrative access or the corresponding bi… |
CVE-2024-58267 | High | 8.0 | 2025-10-02 | A vulnerability has been identified within Rancher Manager whereby the SAML authentication from the Rancher CLI tool is vulnerable to phishing attacks. The cu… |
CVE-2024-58260 | High | 7.6 | 2025-10-02 | A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` field in Rancher can allow users with upda… |
CVE-2025-54468 | Medium | 4.7 | 2025-10-02 | A vulnerability has been identified within Rancher Manager whereby `Impersonate-Extra-*` headers are being sent to an external entity, for example `amazonaws.c… |
CVE-2025-8077 | Critical | 9.8 | 2025-09-17 | A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account… |
CVE-2025-54467 | Medium | 5.3 | 2025-09-17 | When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation the password will appear in the NeuVector secur… |
CVE-2025-53884 | Medium | 5.3 | 2025-09-17 | NeuVector stores user passwords and API keys using a simple, unsalted hash. This method is vulnerable to rainbow table attack (offline attack where hashes of k… |
CVE-2024-58259 | High | 8.2 | 2025-09-02 | A vulnerability has been identified within Rancher Manager in which it did not enforce request body size limits on certain public (unauthenticated) and authe… |
CVE-2024-52284 | High | 7.7 | 2025-09-02 | Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing cred… |
CVE-2025-46809 | Medium | 5.7 | 2025-07-31 | A Plaintext Storage of a Password vulnerability in SUSE exposes the credentials for the HTTP proxy in the log files. This issue affects Container suse/manager/… |
CVE-2025-46811 | Critical | 9.8 | 2025-07-30 | A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability to connect to port 443 of SUSE Manager is able to run any command as… |
CVE-2025-6018 | High | 7.8 | 2025-07-23 | A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unp… |
CVE-2025-53882 | Medium | 4.4 | 2025-07-23 | A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSE mailman3 package allows the mailman user to sen… |
CVE-2025-32463 | Critical | 9.3 | 2025-06-30 | Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option. |
CVE-2025-23393 | Medium | 5.2 | 2025-05-27 | A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in spacewalk-java allows execution of arbitrary Javascript code… |
CVE-2025-46802 | Medium | 6.0 | 2025-05-26 | For a short time they PTY is set to mode 666, allowing any user on the system to connect to the screen session. |
CVE-2025-23394 | Critical | 9.8 | 2025-05-26 | A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumb… |
CVE-2025-23392 | Medium | 5.2 | 2025-05-26 | A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in spacewalk-java allows execution of arbitrary Javascript code o… |
CVE-2024-52281 | High | 8.9 | 2025-04-16 | A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through th… |
CVE-2024-22036 | Critical | 9.1 | 2025-04-16 | A vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the chroot jail and gain root access to the Rancher co… |
CVE-2023-32197 | Medium | 6.6 | 2025-04-16 | A Improper Privilege Management vulnerability in SUSE rancher in RoleTemplateobjects when external=true is set can lead to privilege escalation in specific sce… |
CVE-2024-52280 | High | 7.7 | 2025-04-11 | A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher which allows users to watch resources they are not allowed to acces… |
CVE-2025-23391 | Critical | 9.1 | 2025-04-11 | A Incorrect Privilege Assignment vulnerability in SUSE rancher allows a Restricted Administrator to change the password of Administrators and take over their a… |
CVE-2025-23389 | High | 8.4 | 2025-04-11 | A Improper Access Control vulnerability in SUSE rancher allows a local user to impersonate other identities through SAML Authentication on first login. This is… |
CVE-2025-23388 | High | 8.2 | 2025-04-11 | A Stack-based Buffer Overflow vulnerability in SUSE rancher allows for denial of service.This issue affects rancher: from 2.8.0 before 2.8.13, from 2.9.0 befor… |
CVE-2025-23387 | Medium | 5.3 | 2025-04-11 | A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowed unauthenticated users to list all CLI authentication tokens… |
CVE-2024-52282 | Medium | 6.2 | 2025-04-11 | A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowing any users with GET access to the Rancher Manager Apps Cata… |
CVE-2025-23386 | High | 7.8 | 2025-04-10 | A Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed package gerbera allows the service user gerbera to escalate to root.,This issue affect… |
CVE-2024-12087 | Medium | 6.5 | 2025-01-14 | A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client option… |
CVE-2024-12086 | Medium | 6.1 | 2025-01-14 | A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are b… |
CVE-2024-12085 | High | 7.5 | 2025-01-14 | A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length… |
CVE-2024-52283 | Medium | 5.7 | 2024-11-28 | Missing sanitation of inputs allowed arbitrary users to conduct a stored XSS attack that triggers for users that view a certain project |
CVE-2024-49503 | Low | 3.5 | 2024-11-28 | A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in SUSE manager allows attackers to execute Javascr… |
CVE-2024-49502 | Low | 3.5 | 2024-11-28 | A Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in the Setup Wizard, HTTP Proxy credentials pane in… |
CVE-2024-22038 | High | 7.3 | 2024-11-28 | Various problems in obs-scm-bridge allows attackers that create specially crafted git repositories to leak information of cause denial of service. |
CVE-2024-22037 | Medium | 5.5 | 2024-11-28 | The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be shown users, but the e… |
CVE-2024-49504 | | 2024-11-13 | grub2 allowed attackers with access to the grub shell to access files on the encrypted disks. | |
CVE-2022-45157 | Critical | 9.1 | 2024-11-13 | A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials u… |
CVE-2024-46956 | High | 7.8 | 2024-11-10 | An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution. |
CVE-2024-46955 | Medium | 5.5 | 2024-11-10 | An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. There is an out-of-bounds read when reading color in Indexed color space. |
CVE-2024-46953 | High | 7.8 | 2024-11-10 | An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow when parsing the filename format string (for the output f… |
CVE-2024-46951 | High | 7.8 | 2024-11-10 | An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. An unchecked Implementation pointer in Pattern color space could lead to arbitra… |
CVE-2024-22034 | Medium | 5.5 | 2024-10-16 | Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for t… |
CVE-2024-22033 | Medium | 6.3 | 2024-10-16 | The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that al… |
CVE-2024-22032 | Medium | 6.5 | 2024-10-16 | A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled. When reconciling… |
CVE-2024-22030 | High | 8.0 | 2024-10-16 | A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle (MITM) attack. An attacker would… |
CVE-2024-22029 | High | 7.8 | 2024-10-16 | Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root |
CVE-2023-32189 | Medium | 5.9 | 2024-10-16 | Insecure handling of ssh keys used to bootstrap clients allows local attackers to potentially gain access to the keys |
CVE-2023-32196 | Medium | 6.6 | 2024-10-16 | A vulnerability has been identified whereby privilege escalation checks are not properly enforced for RoleTemplateobjects when external=true, which in specific… |
CVE-2023-32194 | High | 7.2 | 2024-10-16 | A vulnerability has been identified when granting a create or * global role for a resource type of "namespaces"; no matter the API group, the subject will rece… |
CVE-2023-32193 | High | 8.3 | 2024-10-16 | A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman's public API endpoint can be exploited. This can lead to an… |
CVE-2023-32192 | High | 8.3 | 2024-10-16 | A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in the API Server's public API endpoint can be exploited, allowing an… |
CVE-2023-32191 | Critical | 9.9 | 2024-10-16 | When RKE provisions a cluster, it stores the cluster state in a configmap called `full-cluster-state` inside the `kube-system` namespace of the cluster itself… |
CVE-2023-32190 | High | 7.8 | 2024-10-16 | mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable by abusing insecure file operations that run with root privileges. |