# cve.now: Suse

The newest entries naming Suse as an affected vendor (up to 200), of 253 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-116472](https://cve.now/CVE-2026-116472.md): ingress-nginx mirror-target self-DOS (CVSS 2.7)
- [CVE-2026-88811](https://cve.now/CVE-2026-88811.md): Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy (CVSS 9.1)
- [CVE-2026-88810](https://cve.now/CVE-2026-88810.md): Privilege escalation in downstream clusters via GlobalRole inheritedNamespacedRules (CVSS 7.2)
- [CVE-2026-88809](https://cve.now/CVE-2026-88809.md): Rancher meta proxy allowlist bypass leading to server-side request forgery (CVSS 7.6)
- [CVE-2026-94290](https://cve.now/CVE-2026-94290.md): Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller (CVSS 9.1)
- [CVE-2026-104623](https://cve.now/CVE-2026-104623.md): Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster (CVSS 6.3)
- [CVE-2026-104615](https://cve.now/CVE-2026-104615.md): Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace (CVSS 7.9)
- [CVE-2026-104618](https://cve.now/CVE-2026-104618.md): sdbootutil: world-readable debug log (CVSS 6.2)
- [CVE-2026-104617](https://cve.now/CVE-2026-104617.md): sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/\<pid\>/cmdline (CVSS 5.1)
- [CVE-2023-32198](https://cve.now/CVE-2023-32198.md): Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks (CVSS 8.0)
- [CVE-2024-22031](https://cve.now/CVE-2024-22031.md): Rancher users who can create Projects can gain access to arbitrary projects (CVSS 8.5)
- [CVE-2025-23390](https://cve.now/CVE-2025-23390.md): Fleet doesn’t validate a server’s certificate when connecting through SSH (CVSS 6.3)
- [CVE-2026-88804](https://cve.now/CVE-2026-88804.md): Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher (CVSS 9.6)
- [CVE-2026-88805](https://cve.now/CVE-2026-88805.md): Session Not Revoked Server-Side on Logout in Rancher (CVSS 8.1)
- [CVE-2026-88808](https://cve.now/CVE-2026-88808.md): Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters (CVSS 8.8)
- [CVE-2026-93540](https://cve.now/CVE-2026-93540.md): Fleet applies namespace labels and annotations without the bundle's service account privileges (CVSS 6.5)
- [CVE-2026-93539](https://cve.now/CVE-2026-93539.md): Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver (CVSS 5.4)
- [CVE-2026-93538](https://cve.now/CVE-2026-93538.md): Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet (CVSS 7.1)
- [CVE-2026-93537](https://cve.now/CVE-2026-93537.md): Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory (CVSS 6.5)
- [CVE-2026-78424](https://cve.now/CVE-2026-78424.md): OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes (CVSS 8.8)
- [CVE-2026-78427](https://cve.now/CVE-2026-78427.md): Admission Control Bypass via Hardcoded Sidecar Image Exemption (CVSS 5.3)
- [CVE-2026-78425](https://cve.now/CVE-2026-78425.md): SAML Audience Confusion Allows Cross-SP Authentication (CVSS 7.6)
- [CVE-2026-78426](https://cve.now/CVE-2026-78426.md): Logout bypass via alternate JWT spelling (CVSS 2.0)
- [CVE-2026-78428](https://cve.now/CVE-2026-78428.md): Flaw in Neuvector can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently (CVSS 8.8)
- [CVE-2026-44940](https://cve.now/CVE-2026-44940.md): Service token exposure and potential privilege escalation in SUSE Observability (CVSS 5.7)
- [CVE-2026-44950](https://cve.now/CVE-2026-44950.md): fs\_read\_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2 (CVSS 9.0)
- [CVE-2026-59679](https://cve.now/CVE-2026-59679.md): fs\_read\_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2 (CVSS 9.0)
- [CVE-2025-46808](https://cve.now/CVE-2025-46808.md): Sensitive information is leaked into NeuVector’s manager container logs (CVSS 6.8)
- [CVE-2026-75036](https://cve.now/CVE-2026-75036.md): Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing (CVSS 5.3)
- [CVE-2026-75035](https://cve.now/CVE-2026-75035.md): Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass (CVSS 7.7)
- [CVE-2026-75034](https://cve.now/CVE-2026-75034.md): Rancher: SAML Assertion Replay (CVSS 7.4)
- [CVE-2026-75033](https://cve.now/CVE-2026-75033.md): Rancher: Cross-Cluster Secret Leakage via Namespace projectId Annotation Spoofing (CVSS 7.7)
- [CVE-2026-71404](https://cve.now/CVE-2026-71404.md): Rancher: Ownership-less ClusterRole overwrite via attacker-controlled cr-name annotation on GlobalRole (CVSS 8.7)
- [CVE-2026-71403](https://cve.now/CVE-2026-71403.md): Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind (CVSS 6.1)
- [CVE-2026-25706](https://cve.now/CVE-2026-25706.md): yast2-samba-client: OS command injection via attacker-controlled Organizational Unit (Active Directory-supplied) (CVSS 7.5)
- [CVE-2026-59681](https://cve.now/CVE-2026-59681.md): yast2-auth-client: OS command injection via unsanitized Organizational Unit / dnsHostName in AD join (CVSS 8.8)
- [CVE-2026-59680](https://cve.now/CVE-2026-59680.md): yast2-users: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute (CVSS 8.0)
- [CVE-2026-71402](https://cve.now/CVE-2026-71402.md): wicked: out-of-bounds read in the DHCPv4 option parser due to payload length taken from the IP total length (CVSS 5.3)
- [CVE-2026-71401](https://cve.now/CVE-2026-71401.md): wicked: integer underflow of the UDP length in ni\_capture\_inspect\_udp\_header() leads to an out-of-bounds read (CVSS 5.3)
- [CVE-2026-44945](https://cve.now/CVE-2026-44945.md): Cross-Cluster Impersonation Confused-Deputy Privilege Escalation (CVSS 9.1)
- [CVE-2026-25703](https://cve.now/CVE-2026-25703.md): Potential information leakage from manager /network/graph API in NeuVector (CVSS 7.3)
- [CVE-2026-55998](https://cve.now/CVE-2026-55998.md): Cluster Existence Oracle via Unauthenticated Import Endpoint (CVSS 5.3)
- [CVE-2026-59675](https://cve.now/CVE-2026-59675.md): Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service (CVSS 7.5)
- [CVE-2026-55996](https://cve.now/CVE-2026-55996.md): Unauthenticated Denial-of-Service via TLS SAN Stuffing in Rancher and cattle-cluster-agent (CVSS 4.3)
- [CVE-2025-8412](https://cve.now/CVE-2025-8412.md): VMDP: Potential buffer overflow in the RtlQueryRegistryValues function (CVSS 2.0)
- [CVE-2026-59674](https://cve.now/CVE-2026-59674.md): LPE from suricata user to root due to chown in %post in suricata packaging (CVSS 7.1)
- [CVE-2026-44938](https://cve.now/CVE-2026-44938.md): Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent (CVSS 8.8)
- [CVE-2026-44937](https://cve.now/CVE-2026-44937.md): SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components (CVSS 8.3)
- [CVE-2026-44936](https://cve.now/CVE-2026-44936.md): Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml (CVSS 5.0)
- [CVE-2026-44934](https://cve.now/CVE-2026-44934.md): Exposed tokens in SUSE Rancher AI Agent logs (CVSS 7.0)
- [CVE-2026-44935](https://cve.now/CVE-2026-44935.md): Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated \`valuesFrom\` references in Helm Deployer (CVSS 9.9)
- [CVE-2026-44941](https://cve.now/CVE-2026-44941.md): libzypp path traversal via "keyhint" in repomd.xml (CVSS 8.4)
- [CVE-2026-44948](https://cve.now/CVE-2026-44948.md): Path Traversal in Rancher Fleet ImageScan GitRepo Path Handler (CVSS 5.3)
- [CVE-2026-44949](https://cve.now/CVE-2026-44949.md): Unauthenticated namespace creation and RBAC injection via rancher-webhook FleetWorkspace mutating webhook (CVSS 7.0)
- [CVE-2026-44947](https://cve.now/CVE-2026-44947.md): Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher (CVSS 6.9)
- [CVE-2026-44946](https://cve.now/CVE-2026-44946.md): SAML Authentication Replay in Rancher (CVSS 9.5)
- [CVE-2026-41053](https://cve.now/CVE-2026-41053.md): Over-inclusive team membership expansion in GitHub App authentication provider for Rancher (CVSS 8.8)
- [CVE-2026-41052](https://cve.now/CVE-2026-41052.md): Rancher Privilege Escalation from Project Owner to Host (CVSS 9.4)
- [CVE-2026-25707](https://cve.now/CVE-2026-25707.md): Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp (CVSS 8.8)
- [CVE-2026-44939](https://cve.now/CVE-2026-44939.md): Command injection through unsanitized YAML parameter in Rancher (CVSS 9.4)
- [CVE-2026-44942](https://cve.now/CVE-2026-44942.md): libzypp .repo files can have an optional path which can lead to path traversal attacks (CVSS 6.5)
- [CVE-2025-71261](https://cve.now/CVE-2025-71261.md): Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS (CVSS 8.6)
- [CVE-2026-44932](https://cve.now/CVE-2026-44932.md): indirect remote shell command injection via unsanitized DHCP options in wicked (CVSS 8.8)
- [CVE-2026-41054](https://cve.now/CVE-2026-41054.md): Missing exit out of permission check in haveged could lead to root exploit (CVSS 7.8)
- [CVE-2026-44933](https://cve.now/CVE-2026-44933.md): Path Traversal in Plugin Loading in libzypp (CVSS 7.8)
- [CVE-2026-41051](https://cve.now/CVE-2026-41051.md): csync2 uses insecure temporary directories when compiled with C99 or later (CVSS 5.1)
- [CVE-2026-41050](https://cve.now/CVE-2026-41050.md): Helm impersonation bypass of \`RESTClientGetter\` retains \`cluster-admin\` during template rendering (CVSS 9.9)
- [CVE-2026-25705](https://cve.now/CVE-2026-25705.md): Rancher Extensions have arbitrary file access via path traversal (CVSS 8.4)
- [CVE-2026-25702](https://cve.now/CVE-2026-25702.md): nftables disabled due to incorrect kernel backport (CVSS 7.3)
- [CVE-2025-62879](https://cve.now/CVE-2025-62879.md): Rancher Backup Operator pod's logs leak S3 tokens (CVSS 6.8)
- [CVE-2025-62878](https://cve.now/CVE-2025-62878.md): Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern (CVSS 9.9)
- [CVE-2025-67601](https://cve.now/CVE-2025-67601.md): Rancher CLI skips TLS verification on Rancher CLI login command (CVSS 8.3)
- [CVE-2025-67860](https://cve.now/CVE-2025-67860.md): NeuVector scanner insecurely handles passwords as command arguments (CVSS 3.8)
- [CVE-2025-62877](https://cve.now/CVE-2025-62877.md): Harvest may expose OS default ssh login password via SUSE Virtualization Interactive Installer (CVSS 9.8)
- [CVE-2025-66001](https://cve.now/CVE-2025-66001.md): NeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM) (CVSS 8.8)
- [CVE-2025-62875](https://cve.now/CVE-2025-62875.md): Local DoS in OpenSMTPD via UNIX domain socket smtpd.sock (CVSS 6.9)
- [CVE-2025-62876](https://cve.now/CVE-2025-62876.md): A Execution with Unnecessary Privileges vulnerability in lightdm-kde-greeter allows escalation from the service user to root.This issue affe (CVSS 5.3)
- [CVE-2025-53883](https://cve.now/CVE-2025-53883.md): spacewalk-java has various XSS issues on search page (CVSS 9.3)
- [CVE-2025-53880](https://cve.now/CVE-2025-53880.md): susemanager-tftpsync-recv allows arbitrary file creation and deletion due to path traversal (CVSS 8.7)
- [CVE-2025-54471](https://cve.now/CVE-2025-54471.md): NeuVector is shipping cryptographic material into its binary (CVSS 6.5)
- [CVE-2025-54469](https://cve.now/CVE-2025-54469.md): NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow (CVSS 9.9)
- [CVE-2025-54470](https://cve.now/CVE-2025-54470.md): NeuVector telemetry sender is vulnerable to MITM and DoS (CVSS 8.6)
- [CVE-2024-58269](https://cve.now/CVE-2024-58269.md): Rancher exposes sensitive information through audit logs (CVSS 4.3)
- [CVE-2023-32199](https://cve.now/CVE-2023-32199.md): Rancher user retains access to clusters despite Global Role removal (CVSS 4.3)
- [CVE-2024-58260](https://cve.now/CVE-2024-58260.md): Rancher update on users can deny the service to the admin (CVSS 7.6)
- [CVE-2024-58267](https://cve.now/CVE-2024-58267.md): Rancher CLI SAML authentication is vulnerable to phishing attacks (CVSS 8.0)
- [CVE-2025-54468](https://cve.now/CVE-2025-54468.md): Rancher sends sensitive information to external services through the \`/meta/proxy\` endpoint (CVSS 4.7)
- [CVE-2025-8077](https://cve.now/CVE-2025-8077.md): NeuVector admin account has insecure default password (CVSS 9.8)
- [CVE-2025-54467](https://cve.now/CVE-2025-54467.md): NeuVector process with sensitive arguments lead to leakage (CVSS 5.3)
- [CVE-2025-53884](https://cve.now/CVE-2025-53884.md): NeuVector has an insecure password storage vulnerable to rainbow attack (CVSS 5.3)
- [CVE-2024-58259](https://cve.now/CVE-2024-58259.md): Rancher affected by unauthenticated Denial of Service (CVSS 8.2)
- [CVE-2024-52284](https://cve.now/CVE-2024-52284.md): Rancher Fleet Helm Values are stored inside BundleDeployment in plain text (CVSS 7.7)
- [CVE-2025-46809](https://cve.now/CVE-2025-46809.md): Multi Linux Manager epxoses the plain text HTTP Proxy user:password in logs (CVSS 6.9)
- [CVE-2025-46811](https://cve.now/CVE-2025-46811.md): SUSE Multi Linux Manager allows code execution via unprotected websocket endpoint (CVSS 9.8)
- [CVE-2025-53882](https://cve.now/CVE-2025-53882.md): The logrotate configuration in the python-mailman of openSUSE allows the mailman user to sent SIGHUP to arbitrary proceess (CVSS 4.4)
- [CVE-2025-23393](https://cve.now/CVE-2025-23393.md): Reflected XSS in spacewalk-java (CVSS 5.2)
- [CVE-2025-23392](https://cve.now/CVE-2025-23392.md): Reflected XSS in SystemsController.java in spacewalk-java (CVSS 5.2)
- [CVE-2025-23394](https://cve.now/CVE-2025-23394.md): daily-backup.sh script in cyrus-imapd allows escalation from cyrus to root (CVSS 9.8)
- [CVE-2025-46802](https://cve.now/CVE-2025-46802.md): Temporary chown() of users' TTY to mode 0666 allows PTY hijacking in screen (CVSS 6.0)
- [CVE-2023-32197](https://cve.now/CVE-2023-32197.md): Rancher's External RoleTemplates can lead to privilege escalation (CVSS 6.6)
- [CVE-2024-22036](https://cve.now/CVE-2024-22036.md): Rancher Remote Code Execution via Cluster/Node Drivers (CVSS 9.1)
- [CVE-2024-52281](https://cve.now/CVE-2024-52281.md): Stored Cross-site Scripting vulnerability in Rancher UI (CVSS 8.9)
- [CVE-2024-52280](https://cve.now/CVE-2024-52280.md): Users can issue watch commands for arbitrary resources (CVSS 7.7)
- [CVE-2024-52282](https://cve.now/CVE-2024-52282.md): Rancher Helm Applications may have sensitive values leaked (CVSS 6.2)
- [CVE-2025-23387](https://cve.now/CVE-2025-23387.md): Rancher's SAML-based login via CLI can be denied by unauthenticated users (CVSS 5.3)
- [CVE-2025-23388](https://cve.now/CVE-2025-23388.md): Unauthenticated stack overflow in /v3-public/authproviders API (CVSS 8.2)
- [CVE-2025-23389](https://cve.now/CVE-2025-23389.md): Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login (CVSS 8.4)
- [CVE-2025-23391](https://cve.now/CVE-2025-23391.md): Rancher: Restricted Administrator can change Administrator's passwords (CVSS 9.1)
- [CVE-2025-23386](https://cve.now/CVE-2025-23386.md): gerbera: Privilege escalation from user gerbera to root because of insecure %post script (CVSS 7.8)
- [CVE-2024-22037](https://cve.now/CVE-2024-22037.md): Database password leaked by systemd uyuni-server-attestation service (CVSS 5.5)
- [CVE-2024-22038](https://cve.now/CVE-2024-22038.md): DoS attacks, information leaks etc. with crafted Git repositories in obs-scm-bridge (CVSS 7.3)
- [CVE-2024-49502](https://cve.now/CVE-2024-49502.md): Reflected XSS in Setup Wizard, HTTP Proxy credentials pane in spacewalk-web (CVSS 4.6)
- [CVE-2024-49503](https://cve.now/CVE-2024-49503.md): Reflected XSS in Setup Wizard, Organization Credentials in spacewalk-web (CVSS 4.6)
- [CVE-2024-52283](https://cve.now/CVE-2024-52283.md): Missing sanitation of inputs allowed arbitrary users to conduct a stored XSS attack that triggers for users that view a certain project (CVSS 5.7)
- [CVE-2024-49504](https://cve.now/CVE-2024-49504.md): grub2 allows bypassing TPM-bound disk encryption on SL(E)M encrypted Images (CVSS 7.0)
- [CVE-2022-45157](https://cve.now/CVE-2022-45157.md): Exposure of vSphere's CPI and CSI credentials in Rancher (CVSS 9.1)
- [CVE-2023-32189](https://cve.now/CVE-2023-32189.md): Insecure handling SSH key in SUSE Manager when bootstrapping new clients (CVSS 5.9)
- [CVE-2024-22034](https://cve.now/CVE-2024-22034.md): Crafted projects can overwrite special files in the .osc config directory (CVSS 5.5)
- [CVE-2024-22033](https://cve.now/CVE-2024-22033.md): obs-service-download\_url is vulnerable to argument injection (CVSS 6.3)
- [CVE-2024-22032](https://cve.now/CVE-2024-22032.md): Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec (CVSS 6.5)
- [CVE-2024-22030](https://cve.now/CVE-2024-22030.md): Rancher agents can be hijacked by taking over the Rancher Server URL (CVSS 8.0)
- [CVE-2024-22029](https://cve.now/CVE-2024-22029.md): tomcat packaging allows for escalation to root from tomcat user (CVSS 7.8)
- [CVE-2023-32196](https://cve.now/CVE-2023-32196.md): Rancher's External RoleTemplates can lead to privilege escalation (CVSS 6.6)
- [CVE-2023-32194](https://cve.now/CVE-2023-32194.md): Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core' (CVSS 7.2)
- [CVE-2023-32193](https://cve.now/CVE-2023-32193.md): Norman API Cross-site Scripting Vulnerability (CVSS 8.3)
- [CVE-2023-32192](https://cve.now/CVE-2023-32192.md): Rancher API Server Cross-site Scripting Vulnerability (CVSS 8.3)
- [CVE-2023-32191](https://cve.now/CVE-2023-32191.md): rke's credentials are stored in the RKE1 Cluster state ConfigMap (CVSS 9.9)
- [CVE-2023-32190](https://cve.now/CVE-2023-32190.md): mlocate's %post script allows RUN\_UPDATEDB\_AS user to make arbitrary files world readable (CVSS 8.5)
- [CVE-2023-32188](https://cve.now/CVE-2023-32188.md): JWT token compromise can allow malicious actions including Remote Code Execution (RCE) (CVSS 9.4)
- [CVE-2023-22650](https://cve.now/CVE-2023-22650.md): Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider (CVSS 8.8)
- [CVE-2023-22649](https://cve.now/CVE-2023-22649.md): Rancher 'Audit Log' leaks sensitive information (CVSS 8.4)
- [CVE-2023-22644](https://cve.now/CVE-2023-22644.md): JWT token compromise can allow malicious actions including Remote Code Execution (RCE) (CVSS 9.4)
- [CVE-2023-32182](https://cve.now/CVE-2023-32182.md): A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SU (CVSS 5.9)
- [CVE-2023-32186](https://cve.now/CVE-2023-32186.md): A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/sup (CVSS 7.5)
- [CVE-2023-32187](https://cve.now/CVE-2023-32187.md): An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/sup (CVSS 7.5)
- [CVE-2022-43760](https://cve.now/CVE-2022-43760.md): An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some h (CVSS 8.4)
- [CVE-2023-22647](https://cve.now/CVE-2023-22647.md): An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existing permissions to manipulate K (CVSS 9.9)
- [CVE-2023-22648](https://cve.now/CVE-2023-22648.md): A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they (CVSS 8.0)
- [CVE-2023-22651](https://cve.now/CVE-2023-22651.md): Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. (CVSS 9.9)
- [CVE-2023-22645](https://cve.now/CVE-2023-22645.md): kubewarden: Excessive permissions for kubewarden-controller-manager-cluster-role (CVSS 8.0)
- [CVE-2022-45155](https://cve.now/CVE-2022-45155.md): obs-service-go\_modules: arbitrary directory delete (CVSS 5.5)
- [CVE-2022-45154](https://cve.now/CVE-2022-45154.md): supportconfig does not remove passwords in /etc/iscsi/iscsid.conf and /etc/target/lio\_setup.sh (CVSS 4.4)
- [CVE-2022-45153](https://cve.now/CVE-2022-45153.md): saphanabootstrap-formula: Escalation to root for arbitrary users in hana/ha\_cluster.sls (CVSS 7.0)
- [CVE-2023-22643](https://cve.now/CVE-2023-22643.md): libzypp-plugin-appdata: potential arbitrary code execution via shell injection due to \`os.system\` calls (CVSS 6.3)
- [CVE-2022-43759](https://cve.now/CVE-2022-43759.md): Rancher: Privilege escalation via promoted roles (CVSS 7.2)
- [CVE-2022-43758](https://cve.now/CVE-2022-43758.md): Rancher: Command injection in Git package (CVSS 7.6)
- [CVE-2022-43757](https://cve.now/CVE-2022-43757.md): Rancher: Exposure of sensitive fields (CVSS 9.9)
- [CVE-2022-43756](https://cve.now/CVE-2022-43756.md): Rancher/Wrangler: Denial of service when processing Git credentials (CVSS 5.9)
- [CVE-2022-43755](https://cve.now/CVE-2022-43755.md): Rancher: Non-random authentication token (CVSS 7.1)
- [CVE-2022-31254](https://cve.now/CVE-2022-31254.md): rmt-server-pubcloud allows to escalate from user \_rmt to root (CVSS 7.8)
- [CVE-2022-31249](https://cve.now/CVE-2022-31249.md): \[RANCHER\] OS command injection in Rancher and Fleet (CVSS 7.5)
- [CVE-2022-21953](https://cve.now/CVE-2022-21953.md): Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster (CVSS 7.4)
- [CVE-2022-43754](https://cve.now/CVE-2022-43754.md): SUMA/UYUNI reflected cross site scripting in /rhn/audit/scap/Search.do (CVSS 2.6)
- [CVE-2022-43753](https://cve.now/CVE-2022-43753.md): SUMA/UYUNI arbitrary file disclosure vulnerability in ScapResultDownload (CVSS 4.3)
- [CVE-2022-31255](https://cve.now/CVE-2022-31255.md): SUMA/UYUNI directory path traversal vulnerability in CobblerSnipperViewAction (CVSS 4.3)
- [CVE-2022-31256](https://cve.now/CVE-2022-31256.md): sendmail: mail to root privilege escalation via sm-client.pre script (CVSS 7.7)
- [CVE-2022-31252](https://cve.now/CVE-2022-31252.md): permissions: chkstat does not check for group-writable parent directories or target files in safeOpen() (CVSS 4.4)
- [CVE-2022-31251](https://cve.now/CVE-2022-31251.md): slurm: %post for slurm-testsuite operates as root in user owned directory (CVSS 6.5)
- [CVE-2022-31247](https://cve.now/CVE-2022-31247.md): Rancher: Downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB) (CVSS 9.1)
- [CVE-2021-36783](https://cve.now/CVE-2021-36783.md): Rancher: Failure to properly sanitize credentials in cluster template answers (CVSS 9.9)
- [CVE-2021-36782](https://cve.now/CVE-2021-36782.md): Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object (CVSS 9.9)
- [CVE-2022-31248](https://cve.now/CVE-2022-31248.md): SUMA user enumeration via weak error message (CVSS 5.3)
- [CVE-2022-21952](https://cve.now/CVE-2022-21952.md): SUMA unauthenticated remote DoS via resource exhaustion (CVSS 7.5)
- [CVE-2022-21951](https://cve.now/CVE-2022-21951.md): Rancher: Weave CNI password is not set if RKE template is used with CNI value overridden (CVSS 6.8)
- [CVE-2022-21949](https://cve.now/CVE-2022-21949.md): Multiple XXE vulnerabilities in OBS (CVSS 8.8)
- [CVE-2021-4200](https://cve.now/CVE-2021-4200.md): Write access to the Catalog for any user when restricted-admin role is enabled (CVSS 5.4)
- [CVE-2021-36784](https://cve.now/CVE-2021-36784.md): Privilege escalation for users with create/update permissions in Global Roles (CVSS 7.2)
- [CVE-2021-36778](https://cve.now/CVE-2021-36778.md): Exposure of repository credentials to external third-party sources (CVSS 7.3)
- [CVE-2021-36776](https://cve.now/CVE-2021-36776.md): Steve API proxy impersonation (CVSS 8.8)
- [CVE-2021-36775](https://cve.now/CVE-2021-36775.md): Deleting PRTBs associated to a group doesn't cause deletion of corresponding RoleBindings (CVSS 8.8)
- [CVE-2022-21947](https://cve.now/CVE-2022-21947.md): rancher desktop: Dashboard API is network accessible (CVSS 8.3)
- [CVE-2021-46705](https://cve.now/CVE-2021-46705.md): grub2-once uses fixed file name in /var/tmp (CVSS 5.1)
- [CVE-2021-36780](https://cve.now/CVE-2021-36780.md): Unauthorized data access from replicas through vulnerable instance manager pods (CVSS 8.1)
- [CVE-2021-36779](https://cve.now/CVE-2021-36779.md): Host operations allowed in privileged Longhorn managed pods (CVSS 9.6)
- [CVE-2021-32000](https://cve.now/CVE-2021-32000.md): clone-master-clean-up: dangerous file system operations (CVSS 3.2)
- [CVE-2021-32001](https://cve.now/CVE-2021-32001.md): K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token (CVSS 6.5)
- [CVE-2019-18906](https://cve.now/CVE-2019-18906.md): cryptctl: client side password hashing is equivalent to clear text password storage (CVSS 9.8)
- [CVE-2021-25321](https://cve.now/CVE-2021-25321.md): arpwatch: Local privilege escalation from runtime user to root (CVSS 7.8)
- [CVE-2021-31998](https://cve.now/CVE-2021-31998.md): inn: %post calls user owned file allowing local privilege escalation to root (CVSS 6.8)
- [CVE-2021-25317](https://cve.now/CVE-2021-25317.md): cups: ownership of /var/log/cups allows the lp user to create files as root (CVSS 3.3)
- [CVE-2021-25314](https://cve.now/CVE-2021-25314.md): hawk: Insecure file permissions (CVSS 7.8)
- [CVE-2021-25316](https://cve.now/CVE-2021-25316.md): Local DoS of VM live migration due to use of static tmp files in detach\_disks.sh in s390-tools (CVSS 3.3)
- [CVE-2021-25313](https://cve.now/CVE-2021-25313.md): Rancher: XSS on /v3/cluster/ (CVSS 7.1)
- [CVE-2021-25315](https://cve.now/CVE-2021-25315.md): salt-api unauthenticated remote code execution (CVSS 9.8)
- [CVE-2020-8027](https://cve.now/CVE-2020-8027.md): openldap uses fixed paths in /tmp (CVSS 7.3)
- [CVE-2020-8030](https://cve.now/CVE-2020-8030.md): skuba: Insecure /tmp usage when joining node to cluster (CVSS 3.6)
- [CVE-2020-8029](https://cve.now/CVE-2020-8029.md): skuba: Insecure handling of private key (CVSS 2.9)
- [CVE-2020-8028](https://cve.now/CVE-2020-8028.md): salt-api is accessible to every user on SUSE Manager Server (CVSS 9.3)
- [CVE-2020-8023](https://cve.now/CVE-2020-8023.md): Local privilege escalation from ldap to root when using OPENLDAP\_CONFIG\_BACKEND=ldap in openldap2 (CVSS 7.7)
- [CVE-2020-8025](https://cve.now/CVE-2020-8025.md): outdated entries in permissions profiles for /var/lib/pcp/tmp/\* may cause security issues (CVSS 6.1)
- [CVE-2019-3681](https://cve.now/CVE-2019-3681.md): osc: stores downloaded (supposed) RPM in network-controlled filesystem paths (CVSS 7.5)
- [CVE-2020-8019](https://cve.now/CVE-2020-8019.md): syslog-ng: Local privilege escalation from new to root in %post (CVSS 7.7)
- [CVE-2020-8022](https://cve.now/CVE-2020-8022.md): User-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviliges (CVSS 7.7)
- [CVE-2020-8018](https://cve.now/CVE-2020-8018.md): User owned /etc in SLES15-SP1-CHOST-BYOS (CVSS 8.4)
- [CVE-2019-18905](https://cve.now/CVE-2019-18905.md): Deprecated functionality in autoyast2 automatically imports gpg keys without checking them (CVSS 4.8)
- [CVE-2019-18904](https://cve.now/CVE-2019-18904.md): Migrations requests can cause DoS on rmt (CVSS 6.5)
- [CVE-2018-17954](https://cve.now/CVE-2018-17954.md): crowbar provision leaks admin password to all nodes in cleartext (CVSS 9.3)
- [CVE-2020-8017](https://cve.now/CVE-2020-8017.md): race condition on texlive-filesystem cron job allows for the deletion of unintended files (CVSS 6.2)
- [CVE-2020-8016](https://cve.now/CVE-2020-8016.md): race condition in the packaging of texlive-filesysten (CVSS 4.9)
- [CVE-2019-3696](https://cve.now/CVE-2019-3696.md): pcp: Local privilege escalation from user pcp to root through migrate\_tempdirs (CVSS 8.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/suse
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.