Opensuse vulnerabilities
83 CVEs and advisories name Opensuse as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-104618sdbootutil: world-readable debug log
- CVE-2026-104617sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/<pid>/cmdline
- CVE-2026-48863Libsolv: stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service
- CVE-2026-56004obs-service-tar_scm: command injection via mercurial handler
- CVE-2026-25701An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects like
- CVE-2025-53881SUSE-specific logrotate configuration allows escalation from mail user/group to root
- CVE-2025-46810A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate
- CVE-2024-49505XSS vulnerability found in OpenSuse MirrorCache
- CVE-2024-49506Fixed temporary file path in aeon-checks allows fixing of disk encryption key
- CVE-2023-32184A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user th
- CVE-2023-32183Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 package allows users with access to the hacluster to escalate t
- CVE-2023-22652Stack buffer overflow in "read_file" function
- CVE-2023-32181Stack buffer overflow in "econf_writeFile" function
- CVE-2022-45153saphanabootstrap-formula: Escalation to root for arbitrary users in hana/ha_cluster.sls
- CVE-2023-22643libzypp-plugin-appdata: potential arbitrary code execution via shell injection due to `os.system` calls
- CVE-2022-31254rmt-server-pubcloud allows to escalate from user _rmt to root
- CVE-2022-21948paste: XSS on the image upload function
- CVE-2022-46163travel-support-program vulnerable to data exfiltration via Ransack query injection
- CVE-2022-31253openldap2: /usr/lib/openldap/start allows ldap user/group to recursively chown arbitrary directory trees to itself
- CVE-2022-31252permissions: chkstat does not check for group-writable parent directories or target files in safeOpen()
- CVE-2022-21950canna: unsafe handling of /tmp/.iroha_unix directory
- CVE-2022-31250keylime %post scriplet allows for privilege escalation from keylime user to root
- CVE-2022-21946suddoers configuration for cscreen not restrictive enough
- CVE-2022-21945cscreen: usage of fixed path /tmp/cscreen.debug
- CVE-2021-36777login-proxy sends password to attacker-provided domain
- CVE-2022-21944watchman: chown in watchman@.socket unit allows symlink attack
- CVE-2021-36781parsec: dangerous 777 permissions for /run/parsec
- CVE-2021-32000clone-master-clean-up: dangerous file system operations
- CVE-2021-25321arpwatch: Local privilege escalation from runtime user to root
- CVE-2021-25322python-HyperKitty: hyperkitty-permissions.sh used during %post allows local privilege escalation from hyperkitty user to root