en
openSUSE is a free, community-driven Linux distribution project that collaborates with SUSE and sponsors to develop and maintain multiple Linux flavors for desktops, servers, and containers. It emphasizes open source tooling (e.g., Open Build Service, YaST, openQA) and a global, volunteer-driven ecosystem.
As of 11/13/2026, opensuse recorded 2 security vulnerabilities in the last 90 days across 1 products, including 0 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, tumbleweed had the most security vulnerabilities in the opensuse ecosystem, with 2 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2020-8015Local privilege escalation in exim package from user mail to rootCVE-2019-3696pcp: Local privilege escalation from user pcp to root through migrate_tempdirsCVE-2019-3695pcp: Local privilege escalation from user pcp to rootCVE-2019-18903wicked: Use-after-free when receiving invalid DHCP6 IA_PD optionCVE-2019-18902wicked: Use-after-free when receiving invalid DHCP6 client options| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2020-8015Local privilege escalation in exim package from user mail to root | Exploitation statusNot confirmed | FixYes |
| Published04/02/2020 |
| SeverityHigh |
CVE-2019-3696pcp: Local privilege escalation from user pcp to root through migrate_tempdirs | Exploitation statusNot confirmed | FixYes | Affected productopenSUSE Leap 15.1 | Published03/03/2020 | SeverityHigh |
|---|
CVE-2019-3695pcp: Local privilege escalation from user pcp to root | Exploitation statusNot confirmed | FixYes | Affected productopenSUSE Leap 15.1 | Published03/03/2020 | SeverityHigh |
|---|
CVE-2019-18903wicked: Use-after-free when receiving invalid DHCP6 IA_PD option | Exploitation statusNot confirmed | FixYes | Affected productFactory | Published03/02/2020 | SeverityHigh |
|---|
CVE-2019-18902wicked: Use-after-free when receiving invalid DHCP6 client options | Exploitation statusNot confirmed | FixYes | Affected productFactory | Published03/02/2020 | SeverityHigh |
|---|
CVE-2019-18897Local privilege escalation from user salt to root | Exploitation statusNot confirmed | FixNo | Affected productFactory | Published03/02/2020 | SeverityHigh |
|---|
CVE-2019-3698nagios cron job allows privilege escalation from user nagios to root | Exploitation statusNot confirmed | FixNo | Affected productFactory | Published02/28/2020 | SeverityMedium |
|---|
CVE-2018-20105yast2-rmt exposes CA private key passhrase in log-file | Exploitation statusNot confirmed | FixYes | Affected productleap | Published01/27/2020 | SeverityMedium |
|---|
CVE-2018-12476obs-service-extract_file's outfilename parameter allows to write files outside of package directory | Exploitation statusNot confirmed | FixYes | Affected productFactory | Published01/27/2020 | SeverityMedium |
|---|
CVE-2019-3700yast: Fallback to DES without configuration in /etc/login.def | Exploitation statusNot confirmed | FixYes | Affected productFactory | Published01/24/2020 | SeverityLow |
|---|
CVE-2019-3699Local privilege escalation from user privoxy to root | Exploitation statusNot confirmed | FixNo | Affected productFactory | Published01/24/2020 | SeverityHigh |
|---|
CVE-2019-3697Local privilege escalation from user gnump3d to root | Exploitation statusNot confirmed | FixNo | Affected productLeap 15.1 | Published01/24/2020 | SeverityHigh |
|---|
CVE-2019-3694Local privilege escalation from munin to root in the packaging of munin | Exploitation statusNot confirmed | FixNo | Affected productFactory | Published01/24/2020 | SeverityHigh |
|---|
CVE-2019-3693Local privilege escalation from user wwwrun to root in the packaging of mailman | Exploitation statusNot confirmed | FixYes | Affected productLeap 15.1 | Published01/24/2020 | SeverityHigh |
|---|
CVE-2019-3692Local privilege escalation from user news to root in the packaging of inn | Exploitation statusNot confirmed | FixNo | Affected productFactory | Published01/24/2020 | SeverityHigh |
|---|
CVE-2019-3691Local privilege escalation from user munge to root | Exploitation statusNot confirmed | FixYes | Affected productFactory | Published01/23/2020 | SeverityHigh |
|---|
CVE-2019-18899apt-cacher-ng insecure use of /run/apt-cacher-ng | Exploitation statusNot confirmed | FixYes | Affected productLeap 15.1 | Published01/23/2020 | SeverityMedium |
|---|
CVE-2019-18898trousers: Local privilege escalation from tss to root | Exploitation statusNot confirmed | FixYes | Affected productFactory | Published01/23/2020 | SeverityHigh |
|---|
CVE-2019-14287CVE-2019-14287 | Exploitation statusActively exploited | FixYes | Affected productUbuntu Linux | Published10/17/2019 | SeverityHigh |
|---|
CVE-2019-11358CVE-2019-11358 | Exploitation statusActively exploited | FixYes | Affected productbackdrop | Published04/19/2019 | SeverityMedium |
|---|
CVE-2018-12479Request controller allows to create requests with arbitrary request IDs | Exploitation statusNot confirmed | FixYes | Affected productopen build service | Published10/09/2018 | SeverityMedium |
|---|
CVE-2018-12478obs-service-replace_using_package_version allows to specify arbitrary input files | Exploitation statusNot confirmed | FixNo | Affected productopen build service | Published10/09/2018 | SeverityMedium |
|---|
CVE-2018-12477obs-service-refresh_patches can be tricked into deleting '..' or other unrelated directories | Exploitation statusNot confirmed | FixYes | Affected productopen build service | Published10/09/2018 | SeverityLow |
|---|
CVE-2018-12474Crafted service parameters allows to induce unexpected behaviour in obs-service-tar_scm | Exploitation statusNot confirmed | FixYes | Affected productopen build service | Published10/09/2018 | SeverityMedium |
|---|
CVE-2018-12473path traversal in obs-service-tar_scm | Exploitation statusNot confirmed | FixYes | Affected productopen build service | Published10/02/2018 | SeverityLow |
|---|
CVE-2014-0594CSRF protection incorrectly disabled | Exploitation statusNot confirmed | FixYes | Affected productopen build service | Published06/08/2018 | SeverityHigh |
|---|
CVE-2013-3703No write permission check in change_role command | Exploitation statusNot confirmed | FixYes | Affected productopen build service | Published06/08/2018 | SeverityHigh |
|---|
CVE-2018-7689Open Build Service arbitrary package modification | Exploitation statusNot confirmed | FixYes | Affected productopen build service | Published06/07/2018 | SeverityHigh |
|---|
CVE-2018-7688Open Build Service accepts arbitrary reviews | Exploitation statusNot confirmed | FixYes | Affected productopen build service | Published06/07/2018 | SeverityHigh |
|---|
CVE-2017-5188OBS worker VM escape via relative symbolic links | Exploitation statusNot confirmed | FixYes | Affected productopen build service | Published03/01/2018 | SeverityMedium |
|---|
CVE-2015-3246CVE-2015-3246 | Exploitation statusKEV | FixYes | Affected productlibuser | Published08/11/2015 | SeverityMedium |
|---|
CVE-2015-3306CVE-2015-3306 | Exploitation statusKEV | FixNo | Affected productdebian_linux | Published05/18/2015 | SeverityCritical |
|---|
CVE-2014-7169Incomplete function parsing in GNU Bash enables crafted-environment file writes | Exploitation statusKEV | FixYes | Affected producteos | Published09/25/2014 | SeverityCritical |
|---|
CVE-2014-6271Environment-variable command injection enables arbitrary code execution in GNU Bash | Exploitation statusKEV | FixYes | Affected producteos | Published09/24/2014 | SeverityCritical |
|---|
84 Results | Page 2 of 2