Opensuse Tumbleweed (Suse) - vulnerabilities (CVEs)
13 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-09-10. Vendor: Suse.
CVEs of Opensuse Tumbleweed
- CVE-2026-44950 - CVSS 9.5 (critical), 2026-09-10: fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that…
- CVE-2026-59679 - CVSS 9.2 (critical), 2026-09-10: fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16…
- CVE-2026-59674 - CVSS 7.1 (high), 2026-07-14: A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user to escalate to root. This issue…
- CVE-2026-41051 - CVSS 5.1 (medium), 2026-05-13: csync2 uses insecure temporary directories when compiled with C99 or later, allowing for TOCTOU style attacks on the temporary directories.
- CVE-2025-62875 - CVSS 6.9 (medium), 2025-11-20: An Improper Check for Unusual or Exceptional Conditions vulnerability in OpenSMTPD allows local users to crash OpenSMTPD. This issue affects openSUSE…
- CVE-2025-53882 - CVSS 4.8 (medium), 2025-07-23: A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSE mailman3 package allows the mailman user to…
- CVE-2025-23394 - CVSS 9.8 (critical), 2025-05-26: A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE…
- CVE-2025-23386 - CVSS 7.8 (high), 2025-04-10: A Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed package gerbera allows the service user gerbera to escalate to root.,This issue…
- CVE-2024-49505 - CVSS 6.1 (medium), 2024-11-13: A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in openSUSE Tumbleweed MirrorCache allows the execution…
- CVE-2024-49504 - CVSS 7 (high), 2024-11-13: grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.
- CVE-2024-22034 - CVSS 5.5 (medium), 2024-10-16: Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for…
- CVE-2024-22033 - CVSS 6.3 (medium), 2024-10-16: The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that…
- CVE-2024-22029 - CVSS 7.8 (high), 2024-10-16: Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root
- CVE-2023-32190 - CVSS 8.5 (high), 2024-10-16: mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable by abusing insecure file operations that run with root privileges.
