Opensuse - vulnerabilities (CVEs)

3295 CVEs in 72 products, 2 in the last 30 days, newest from 2026-10-15.

Products

Leap - 1898 CVEs
Opensuse - 1456 CVEs
Backports Sle - 326 CVEs
Backports - 96 CVEs
Evergreen - 44 CVEs
Factory - 24 CVEs
Open Build Service - 20 CVEs
Libsolv - 13 CVEs
Opensuse Leap 15.1 - 13 CVEs
Tumbleweed - 9 CVEs
Leap 15.1 - 8 CVEs
Libzypp - 7 CVEs
Opensuse Leap 15.2 - 6 CVEs
Supportutils - 6 CVEs
Opensuse Leap 15.4 - 4 CVEs
Leap 15.2 - 3 CVEs
Openbuildservice - 3 CVEs
Openldap2 - 3 CVEs
Opensuse Tumbleweed - 3 CVEs
Zypper - 3 CVEs
Cryptctl - 2 CVEs
Cscreen - 2 CVEs
Libeconf - 2 CVEs
Munge - 2 CVEs
Opensuse Backports Sle-15-sp3 - 2 CVEs
Opensuse Factory - 2 CVEs
Opensuse Leap 15.3 - 2 CVEs
Osc - 2 CVEs
Pcp - 2 CVEs
Rmt-server - 2 CVEs
Suse Linux Enterprise Server - 2 CVEs
Texlive-filesystem - 2 CVEs
Wicked - 2 CVEs
Autoyast2 - 1 CVEs
Build Service - 1 CVEs
Buildservice - 1 CVEs
Canna - 1 CVEs
Cyrus-sasl - 1 CVEs
Factory Watchman - 1 CVEs
Hylafax+ - 1 CVEs
Inn - 1 CVEs
Leap Micro - 1 CVEs
Libstorage - 1 CVEs
Libstorage-ng - 1 CVEs
Libzypp-plugin-appdata - 1 CVEs
Mirrorcache - 1 CVEs
Munin - 1 CVEs
Obs-service-set Version - 1 CVEs
Obs-service-source Validator - 1 CVEs
Open-build-service - 1 CVEs
Open Buildservice - 1 CVEs
Openstack Cloud - 1 CVEs
Opensuse-welcome - 1 CVEs
Opensuse Backports Sle-15-sp1 - 1 CVEs
Opensuse Backports Sle-15-sp2 - 1 CVEs
Opensuse Backports Sle-15-sp4 - 1 CVEs
Opensuse Leap Micro 5.2 - 1 CVEs
Package Hub - 1 CVEs
Paste - 1 CVEs
Python-postorius - 1 CVEs
Sdbootutil - 1 CVEs
Suse Package Hub - 1 CVEs
Sysconfig - 1 CVEs
Tar Scm - 1 CVEs
Travel-support-program - 1 CVEs
Travel Support Program - 1 CVEs
Tumbleweed Kopano-spamd - 1 CVEs
Welcome - 1 CVEs
Yast2-multipath - 1 CVEs
Yast2-printer - 1 CVEs
Yast2-samba-provision - 1 CVEs
Linux Enterprise High Availability Extension - 0 CVEs

Newest CVEs of Opensuse

CVE-2026-104618 - CVSS 6.9 (medium), 2026-10-15: On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means…
CVE-2026-104617 - CVSS 5.9 (medium), 2026-10-15: There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for…
CVE-2026-48863 - CVSS 7.5 (high), 2026-07-16: A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when…
CVE-2026-44941 - CVSS 8.8 (high), 2026-07-02: A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious…
CVE-2026-56004 - CVSS 10 (critical), 2026-07-02: A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service…
CVE-2026-25707 - CVSS 8.8 (high), 2026-06-29: A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories…
CVE-2026-48864 - CVSS 7.8 (high), 2026-05-26: A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to…
CVE-2026-9149 - CVSS 6.5 (medium), 2026-05-21: A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size…
CVE-2026-9150 - CVSS 6.5 (medium), 2026-05-20: A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted…
CVE-2026-31431 - CVSS 7.8 (high), 2026-04-22: In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit…
CVE-2026-25701 - CVSS 7 (high), 2026-02-25: An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects like: * gain access to…
CVE-2026-25506 - CVSS 7.8 (high), 2026-02-10: MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow…
CVE-2025-62875 - CVSS 6.9 (medium), 2025-11-20: An Improper Check for Unusual or Exceptional Conditions vulnerability in OpenSMTPD allows local users to crash OpenSMTPD. This issue affects openSUSE…
CVE-2025-53881 - CVSS 6.9 (medium), 2025-10-02: A UNIX Symbolic Link (Symlink) Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/group to root.This…
CVE-2025-46810 - CVSS 8.5 (high), 2025-09-02: A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate to root. This…
CVE-2025-32463 - CVSS 9.3 (critical), 2025-06-30: Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
CVE-2024-49506 - CVSS 7.3 (high), 2024-11-13: Insecure creation of temporary files allows local users on systems with non-default configurations to cause denial of service or set the encryption key for a…
CVE-2024-49505 - CVSS 6.1 (medium), 2024-11-13: A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in openSUSE Tumbleweed MirrorCache allows the execution…
CVE-2023-32182 - CVSS 7.8 (high), 2023-09-19: A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux…
CVE-2023-32184 - CVSS 7.8 (high), 2023-09-19: A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user that runs…
CVE-2023-32183 - CVSS 7.8 (high), 2023-07-07: Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 package allows users with access to the hacluster to escalate to root This issue…
CVE-2023-22652 - CVSS 6.5 (medium), 2023-06-01: A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf leads to DoS via malformed config files. This…
CVE-2023-32181 - CVSS 6.5 (medium), 2023-06-01: A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in openSUSE libeconf allows for DoS via malformed configuration files…
CVE-2022-45154 - CVSS 5.5 (medium), 2023-02-15: A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux…
CVE-2022-45153 - CVSS 7.8 (high), 2023-02-15: An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise…
CVE-2022-21948 - CVSS 6.1 (medium), 2023-02-07: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in paste allows remote attackers to place Javascript…
CVE-2022-31254 - CVSS 7.8 (high), 2023-02-07: A Incorrect Default Permissions vulnerability in rmt-server-regsharing service of SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Server for…
CVE-2023-22643 - CVSS 7.8 (high), 2023-02-07: An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in libzypp-plugin-appdata of SUSE Linux Enterprise…
CVE-2022-46163 - CVSS 7.5 (high), 2023-01-10: Travel support program is a rails app to support the travel support program of openSUSE (TSP). Sensitive user data (bank account details, password Hash) can…
CVE-2022-31253 - CVSS 7.8 (high), 2022-11-09: A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of…