Opensuse vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-48863 A flaw was found in libsolv.High 7.5 · Jul 15, 2026
• CVE-2026-56004 A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service filCritical 10 · Jul 2, 2026
• CVE-2026-25701 An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects like: * gain access tHigh 7 · Feb 25, 2026
• CVE-2025-46810 A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate to root.High 8.5 · Sep 2, 2025
• CVE-2024-49506 Insecure creation of temporary files allows local users on systems with non-default configurations to cause denial of service or set the encryption key for a fiHigh 7.3 · Nov 13, 2024
• CVE-2023-32184 A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user that runs opensuse-welHigh 7.8 · Sep 19, 2023
• CVE-2023-32183 Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 package allows users with access to the hacluster to escalate to root This issue afHigh 7.8 · Jul 7, 2023
• CVE-2022-46163 Travel support program is a rails app to support the travel support program of openSUSE (TSP).High 7.5 · Jan 10, 2023
• CVE-2022-31253 A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arbiHigh 7.1 · Nov 9, 2022
• CVE-2022-31250 A UNIX Symbolic Link (Symlink) Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root.High 7.1 · Jul 20, 2022
• CVE-2021-36777 A Reliance on Untrusted Inputs in a Security Decision vulnerability in the login proxy of the openSUSE Build service allowed attackers to present users with a eHigh 8.1 · Mar 9, 2022
• CVE-2022-21944 A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attackersHigh 7.8 · Jan 26, 2022
• CVE-2021-33938 Buffer overflow vulnerability in function prune_to_recommended in src/policy.c in libsolv before 0.7.17 allows attackers to cause a Denial of Service.High 7.5 · Sep 2, 2021
• CVE-2021-33930 Buffer overflow vulnerability in function pool_installable_whatprovides in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service.High 7.5 · Sep 2, 2021
• CVE-2021-33929 Buffer overflow vulnerability in function pool_disabled_solvable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service.High 7.5 · Sep 2, 2021
• CVE-2021-33928 Buffer overflow vulnerability in function pool_installable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Service.High 7.5 · Sep 2, 2021
• CVE-2021-25319 A Incorrect Default Permissions vulnerability in the packaging of virtualbox of openSUSE Factory allows local attackers in the vboxusers groupu to escalate to rHigh 7.8 · May 5, 2021
• CVE-2020-8026 A Incorrect Default Permissions vulnerability in the packaging of inn in openSUSE Leap 15.2, openSUSE Tumbleweed, openSUSE Leap 15.1 allows local attackers withHigh 8.4 · Aug 7, 2020
• CVE-2020-8014 A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of kopano-spamd of openSUSE Leap 15.1, openSUSE Tumbleweed allowed local attackers with High 7.7 · Jun 29, 2020
• CVE-2020-12050 SQLiteODBC 0.9996, as packaged for certain Linux distributions as 0.9996-4, has a race condition leading to root privilege escalation because any user can replaHigh 7 · Apr 30, 2020
• CVE-2020-8015 A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root.High 8.4 · Apr 2, 2020
• CVE-2020-7217 An ni_dhcp4_fsm_process_dhcp4_packet memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 paHigh 7.5 · Feb 11, 2020
• CVE-2020-7216 An ni_dhcp4_parse_response memory leak in openSUSE wicked 0.6.55 and earlier allows network attackers to cause a denial of service by sending DHCP4 packets withHigh 7.5 · Feb 5, 2020
• CVE-2019-3699 UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to escalate from user priHigh 7.7 · Jan 24, 2020
• CVE-2019-3697 UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of gnump3d in openSUSE Leap 15.1 allows local attackers to escalate from user gnump3d to rHigh 7.7 · Jan 24, 2020