Tumbleweed (Opensuse) - vulnerabilities (CVEs)
9 CVEs, 2 in the last 30 days, 5 known versions, newest CVE from 2026-10-15. Vendor: Opensuse.
CVEs of Tumbleweed
- CVE-2026-104618 - CVSS 6.9 (medium), 2026-10-15: On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means…
- CVE-2026-104617 - CVSS 5.9 (medium), 2026-10-15: There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for…
- CVE-2025-62875 - CVSS 6.9 (medium), 2025-11-20: An Improper Check for Unusual or Exceptional Conditions vulnerability in OpenSMTPD allows local users to crash OpenSMTPD. This issue affects openSUSE…
- CVE-2025-53881 - CVSS 6.9 (medium), 2025-10-02: A UNIX Symbolic Link (Symlink) Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/group to root.This…
- CVE-2025-46810 - CVSS 8.5 (high), 2025-09-02: A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate to root. This…
- CVE-2024-49506 - CVSS 7.3 (high), 2024-11-13: Insecure creation of temporary files allows local users on systems with non-default configurations to cause denial of service or set the encryption key for a…
- CVE-2024-49505 - CVSS 6.1 (medium), 2024-11-13: A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in openSUSE Tumbleweed MirrorCache allows the execution…
- CVE-2023-32183 - CVSS 7.8 (high), 2023-07-07: Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 package allows users with access to the hacluster to escalate to root This issue…
- CVE-2022-31250 - CVSS 7.8 (high), 2022-07-20: A UNIX Symbolic Link (Symlink) Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root.…
- CVE-2021-25315 - CVSS 9.8 (critical), 2021-03-03: CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary…
- CVE-2020-8026 - CVSS 8.4 (high), 2020-08-07: A Incorrect Default Permissions vulnerability in the packaging of inn in openSUSE Leap 15.2, openSUSE Tumbleweed, openSUSE Leap 15.1 allows local attackers…
- CVE-2015-3306 - CVSS 10 (critical), 2015-05-18: The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
