tumbleweed
- Software type
- Operating system
- Total vulnerabilities (90 days)
- 2
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/12/2026, tumbleweed recorded 2 security vulnerabilities in the last 90 days, of which 0 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of tumbleweed and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-104618sdbootutil: world-readable debug logCVE-2026-104617sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/<pid>/cmdlineCVE-2025-53881SUSE-specific logrotate configuration allows escalation from mail user/group to rootCVE-2025-46810CVE-2025-46810CVE-2024-49506Fixed temporary file path in aeon-checks allows fixing of disk encryption key| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-104618sdbootutil: world-readable debug log | Exploitation statusNot exploited | FixYes | Published10/15/2026 | SeverityMedium |
CVE-2026-104617sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/<pid>/cmdline | Exploitation statusNot exploited | FixYes | Published10/15/2026 | SeverityMedium |
CVE-2025-53881SUSE-specific logrotate configuration allows escalation from mail user/group to root | Exploitation statusNot exploited | FixYes | Published10/02/2025 | SeverityMedium |
CVE-2025-46810CVE-2025-46810 | Exploitation statusNot exploited | FixYes | Published09/02/2025 | SeverityHigh |
CVE-2024-49506Fixed temporary file path in aeon-checks allows fixing of disk encryption key | Exploitation statusNot exploited | FixYes | Published11/13/2024 | SeverityHigh |
CVE-2024-49505XSS vulnerability found in OpenSuse MirrorCache | Exploitation statusActively exploited | FixYes | Published11/13/2024 | SeverityMedium |
CVE-2023-32183CVE-2023-32183 | Exploitation statusActively exploited | FixNo | Published07/07/2023 | SeverityHigh |
CVE-2022-31250keylime %post scriplet allows for privilege escalation from keylime user to root | Exploitation statusNot confirmed | FixYes | Published07/20/2022 | SeverityHigh |
CVE-2021-25315salt-api unauthenticated remote code execution | Exploitation statusNot confirmed | FixYes | Published03/03/2021 | SeverityCritical |
CVE-2015-3306CVE-2015-3306 | Exploitation statusKEV | FixNo | Published05/18/2015 | SeverityCritical |
10 Results | Page 1 of 1