en
openSUSE is a multinational, community-driven Linux distribution project that provides free operating systems for desktops, servers, and containers. It operates as a collaborative ecosystem with SUSE and other sponsors, aiming to deliver accessible, stable, and open software.
Severity across 4 analyzed records
The GCVE catalog currently lists 3,289 vulnerability records associated with openSUSE.
Among the 4 records analyzed by CyStack, 2 are High or Critical and 1 appear in the CISA KEV catalog for priority remediation.
openSUSE is a multinational community project that develops free Linux distributions for desktops, servers, and containers. The project is sponsored by SUSE and other companies and emphasizes openness, collaboration, and accessibility across a global user base.
| CVE | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-48863Libsolv: stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service | Exploitation statusNot known exploited | FixYes | Affected productlibsolv | Published07/16/2026 | SeverityHigh |
CVE-2026-44941libzypp path traversal via "keyhint" in repomd.xml | Exploitation statusNot known exploited | FixYes | Affected productlibzypp | Published07/02/2026 | SeverityHigh |
CVE-2026-56004obs-service-tar_scm: command injection via mercurial handler | Exploitation statusNot known exploited | FixYes | Affected productbuildservice | Published07/02/2026 | SeverityCritical |
CVE-2026-25707Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp | Exploitation statusNot known exploited | FixYes | Affected productlibzypp | Published06/29/2026 | SeverityHigh |
CVE-2026-48864Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat Enterprise Linux 10 | Published05/26/2026 | SeverityHigh |
CVE-2026-9149Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file | Exploitation statusPublic exploit | FixNot confirmed | Affected productRed Hat Enterprise Linux 10 | Published05/20/2026 | SeverityMedium |
CVE-2026-9150Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums | Exploitation statusNot known exploited | FixNot confirmed | Affected productRed Hat Enterprise Linux 10 | Published05/20/2026 | SeverityMedium |
CVE-2026-31431crypto: algif_aead - Revert to operating out-of-place | Exploitation statusKEV | FixYes | Affected productLinux | Published04/22/2026 | SeverityHigh |
CVE-2026-25701CVE-2026-25701 | Exploitation statusNot known exploited | FixYes | Affected productsdbootutil | Published02/25/2026 | SeverityHigh |
CVE-2026-25506MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery | Exploitation statusNot known exploited | FixYes | Affected productmunge | Published02/10/2026 | SeverityHigh |
CVE-2025-62875Local DoS in OpenSMTPD via UNIX domain socket smtpd.sock | Exploitation statusPublic exploit | FixYes | Affected productopenSUSE Tumbleweed | Published11/20/2025 | SeverityMedium |
CVE-2025-53881SUSE-specific logrotate configuration allows escalation from mail user/group to root | Exploitation statusNot known exploited | FixYes | Affected productTumbleweed | Published10/02/2025 | SeverityMedium |
CVE-2025-46810CVE-2025-46810 | Exploitation statusNot known exploited | FixYes | Affected productTumbleweed | Published09/02/2025 | SeverityHigh |
CVE-2025-32463CVE-2025-32463 | Exploitation statusKEV | FixYes | Affected productSudo | Published06/30/2025 | SeverityCritical |
CVE-2024-49505XSS vulnerability found in OpenSuse MirrorCache | Exploitation statusPublic exploit | FixYes | Affected productTumbleweed | Published11/13/2024 | SeverityMedium |
CVE-2024-49506Fixed temporary file path in aeon-checks allows fixing of disk encryption key | Exploitation statusNot known exploited | FixYes | Affected productTumbleweed | Published11/13/2024 | SeverityHigh |
CVE-2023-32182CVE-2023-32182 | Exploitation statusNot known exploited | FixYes | Affected productSUSE Linux Enterprise Desktop 15 SP5 | Published09/19/2023 | SeverityMedium |
CVE-2023-32184CVE-2023-32184 | Exploitation statusPublic exploit | FixYes | Affected productopensuse-welcome | Published09/19/2023 | SeverityHigh |
CVE-2023-32183CVE-2023-32183 | Exploitation statusPublic exploit | FixNot confirmed | Affected productTumbleweed | Published07/07/2023 | SeverityHigh |
CVE-2023-22652Stack buffer overflow in "read_file" function | Exploitation statusPublic exploit | FixYes | Affected productlibeconf | Published06/01/2023 | SeverityLow |
CVE-2023-32181Stack buffer overflow in "econf_writeFile" function | Exploitation statusPublic exploit | FixYes | Affected productlibeconf | Published06/01/2023 | SeverityLow |
CVE-2022-45154supportconfig does not remove passwords in /etc/iscsi/iscsid.conf and /etc/target/lio_setup.sh | Exploitation statusNot known exploited | FixNot confirmed | Affected productSUSE Linux Enterprise Server 12 | Published02/15/2023 | SeverityMedium |
CVE-2022-45153saphanabootstrap-formula: Escalation to root for arbitrary users in hana/ha_cluster.sls | Exploitation statusNot known exploited | FixYes | Affected productopenSUSE Leap 15.4 | Published02/15/2023 | SeverityHigh |
CVE-2022-21948paste: XSS on the image upload function | Exploitation statusNot known exploited | FixNot confirmed | Affected productpaste | Published02/07/2023 | SeverityMedium |
CVE-2022-31254rmt-server-pubcloud allows to escalate from user _rmt to root | Exploitation statusPublic exploit | FixYes | Affected productopenSUSE Leap 15.3 | Published02/07/2023 | SeverityHigh |
CVE-2023-22643libzypp-plugin-appdata: potential arbitrary code execution via shell injection due to `os.system` calls | Exploitation statusNot known exploited | FixYes | Affected productopenSUSE Leap 15.4 | Published02/07/2023 | SeverityMedium |
CVE-2022-46163travel-support-program vulnerable to data exfiltration via Ransack query injection | Exploitation statusPublic exploit | FixYes | Affected producttravel-support-program | Published01/10/2023 | SeverityHigh |
CVE-2022-31253openldap2: /usr/lib/openldap/start allows ldap user/group to recursively chown arbitrary directory trees to itself | Exploitation statusPublic exploit | FixYes | Affected productFactory | Published11/09/2022 | SeverityHigh |
CVE-2022-31256sendmail: mail to root privilege escalation via sm-client.pre script | Exploitation statusNot known exploited | FixYes | Affected productopenSUSE Factory | Published10/26/2022 | SeverityHigh |
CVE-2022-31252permissions: chkstat does not check for group-writable parent directories or target files in safeOpen() | Exploitation statusNot confirmed | FixYes | Affected productopenSUSE Leap 15.3 | Published10/06/2022 | SeverityMedium |
CVE-2022-31251slurm: %post for slurm-testsuite operates as root in user owned directory | Exploitation statusNot confirmed | FixYes | Affected productopenSUSE Factory | Published09/07/2022 | SeverityMedium |
CVE-2022-21950canna: unsafe handling of /tmp/.iroha_unix directory | Exploitation statusNot confirmed | FixYes | Affected productopenSUSE Backports SLE-15-SP3 | Published09/07/2022 | SeverityMedium |
CVE-2022-31250keylime %post scriplet allows for privilege escalation from keylime user to root | Exploitation statusNot confirmed | FixYes | Affected productTumbleweed | Published07/20/2022 | SeverityHigh |
CVE-2022-21949Multiple XXE vulnerabilities in OBS | Exploitation statusNot confirmed | FixYes | Affected productOpen Build Service | Published05/03/2022 | SeverityHigh |
CVE-2022-21946suddoers configuration for cscreen not restrictive enough | Exploitation statusNot confirmed | FixNot confirmed | Affected productFactory | Published03/16/2022 | SeverityMedium |
CVE-2022-21945cscreen: usage of fixed path /tmp/cscreen.debug | Exploitation statusNot confirmed | FixNot confirmed | Affected productFactory | Published03/16/2022 | SeverityMedium |
CVE-2021-36777login-proxy sends password to attacker-provided domain | Exploitation statusNot confirmed | FixYes | Affected productBuild service | Published03/09/2022 | SeverityHigh |
CVE-2021-44568CVE-2021-44568 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/21/2022 | SeverityUnknown |
CVE-2021-45082CVE-2021-45082 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/18/2022 | SeverityUnknown |
CVE-2022-21944watchman: chown in watchman@.socket unit allows symlink attack | Exploitation statusNot confirmed | FixYes | Affected productopenSUSE Backports SLE-15-SP3 | Published01/26/2022 | SeverityHigh |
CVE-2021-36781parsec: dangerous 777 permissions for /run/parsec | Exploitation statusNot confirmed | FixYes | Affected productFactory | Published01/14/2022 | SeverityMedium |
CVE-2021-46141CVE-2021-46141 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/06/2022 | SeverityUnknown |
CVE-2021-46142CVE-2021-46142 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/06/2022 | SeverityUnknown |
CVE-2021-41819CVE-2021-41819 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/01/2022 | SeverityHigh |
CVE-2021-41817CVE-2021-41817 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/01/2022 | SeverityUnknown |
CVE-2021-4166Out-of-bounds Read in vim/vim | Exploitation statusNot confirmed | FixYes | Affected productvim/vim | Published12/25/2021 | SeverityHigh |
CVE-2021-33938CVE-2021-33938 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/02/2021 | SeverityUnknown |
CVE-2021-33930CVE-2021-33930 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/02/2021 | SeverityUnknown |
CVE-2021-33929CVE-2021-33929 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/02/2021 | SeverityUnknown |
CVE-2021-33928CVE-2021-33928 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/02/2021 | SeverityUnknown |
CVE-2021-32000clone-master-clean-up: dangerous file system operations | Exploitation statusNot confirmed | FixNot confirmed | Affected productFactory | Published07/28/2021 | SeverityLow |
CVE-2019-18906cryptctl: client side password hashing is equivalent to clear text password storage | Exploitation statusNot confirmed | FixYes | Affected productSUSE Linux Enterprise Server for SAP 12-SP5 | Published06/30/2021 | SeverityCritical |
CVE-2021-25321arpwatch: Local privilege escalation from runtime user to root | Exploitation statusNot confirmed | FixYes | Affected productFactory | Published06/30/2021 | SeverityHigh |
CVE-2021-25322python-HyperKitty: hyperkitty-permissions.sh used during %post allows local privilege escalation from hyperkitty user to root | Exploitation statusNot confirmed | FixYes | Affected productLeap 15.2 | Published06/10/2021 | SeverityMedium |
CVE-2021-31997python-postorius: postorius-permissions.sh used during %post allows local privilege escalation from postorius user to root | Exploitation statusNot confirmed | FixNot confirmed | Affected productLeap 15.2 | Published06/10/2021 | SeverityMedium |
CVE-2021-31998inn: %post calls user owned file allowing local privilege escalation to root | Exploitation statusNot confirmed | FixYes | Affected productopenSUSE Backports SLE-15-SP2 | Published06/10/2021 | SeverityMedium |
CVE-2021-3200CVE-2021-3200 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/18/2021 | SeverityUnknown |
CVE-2021-25317cups: ownership of /var/log/cups allows the lp user to create files as root | Exploitation statusNot confirmed | FixYes | Affected productopenSUSE Leap 15.2 | Published05/05/2021 | SeverityLow |
CVE-2021-25319virtualbox: missing sticky bit for /etc/vbox allows local root exploit for members of vboxusers group | Exploitation statusNot confirmed | FixNot confirmed | Affected productFactory | Published05/05/2021 | SeverityHigh |
CVE-2021-25315salt-api unauthenticated remote code execution | Exploitation statusNot confirmed | FixYes | Affected productTumbleweed | Published03/03/2021 | SeverityCritical |
CVE-2020-8032Local privilege escalation to root due to insecure tmp file usage | Exploitation statusNot confirmed | FixNot confirmed | Affected productFactory | Published02/25/2021 | SeverityMedium |
CVE-2020-8027openldap uses fixed paths in /tmp | Exploitation statusNot confirmed | FixYes | Affected productopenSUSE Leap 15.1 | Published02/11/2021 | SeverityHigh |
CVE-2020-8031obs: Stored XSS | Exploitation statusNot confirmed | FixYes | Affected productOpen Build Service | Published02/11/2021 | SeverityMedium |
CVE-2021-26676CVE-2021-26676 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/09/2021 | SeverityUnknown |
CVE-2021-26675CVE-2021-26675 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/09/2021 | SeverityUnknown |
CVE-2020-0569CVE-2020-0569 | Exploitation statusNot confirmed | FixNot confirmed | Affected productIntel(R) PROSet/Wireless WiFi products on Windows 10 | Published11/23/2020 | SeverityUnknown |
CVE-2020-16846CVE-2020-16846 | Exploitation statusKEV | FixNot confirmed | Affected productNot confirmed | Published11/06/2020 | SeverityCritical |
CVE-2020-28049CVE-2020-28049 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published11/04/2020 | SeverityMedium |
CVE-2020-6557CVE-2020-6557 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-16011CVE-2020-16011 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-16009CVE-2020-16009 | Exploitation statusKEV | FixYes | Affected productChrome | Published11/03/2020 | SeverityHigh |
CVE-2020-16007CVE-2020-16007 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-16008CVE-2020-16008 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-16004CVE-2020-16004 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-16005CVE-2020-16005 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-16006CVE-2020-16006 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-16002CVE-2020-16002 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-16003CVE-2020-16003 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-16001CVE-2020-16001 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-16000CVE-2020-16000 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-15992CVE-2020-15992 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-15991CVE-2020-15991 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-15990CVE-2020-15990 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-15989CVE-2020-15989 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-15987CVE-2020-15987 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-15988CVE-2020-15988 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-15985CVE-2020-15985 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-15986CVE-2020-15986 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-15983CVE-2020-15983 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-15984CVE-2020-15984 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-15981CVE-2020-15981 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-15982CVE-2020-15982 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-15980CVE-2020-15980 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-15978CVE-2020-15978 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-15979CVE-2020-15979 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-15976CVE-2020-15976 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-15977CVE-2020-15977 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-15975CVE-2020-15975 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-15974CVE-2020-15974 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CVE-2020-15973CVE-2020-15973 | Exploitation statusNot confirmed | FixYes | Affected productChrome | Published11/03/2020 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
%20PROSet%2FWireless%20WiFi%20products%20on%20Windows%2010.svg){kind=icon}
