openSUSE Tumbleweed
- Software type
- Operating system
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/13/2026, openSUSE Tumbleweed recorded 0 security vulnerabilities in the last 90 days, of which 0 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of openSUSE Tumbleweed and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-59674LPE from suricata user to root due to chown in %post in suricata packagingCVE-2026-41051csync2 uses insecure temporary directories when compiled with C99 or laterCVE-2025-62875Local DoS in OpenSMTPD via UNIX domain socket smtpd.sockCVE-2025-53882The logrotate configuration in the python-mailman of openSUSE allows the mailman user to sent SIGHUP to arbitrary proceessCVE-2025-23394daily-backup.sh script in cyrus-imapd allows escalation from cyrus to root| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-59674LPE from suricata user to root due to chown in %post in suricata packaging | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-41051csync2 uses insecure temporary directories when compiled with C99 or later | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityMedium |
|---|
CVE-2025-62875Local DoS in OpenSMTPD via UNIX domain socket smtpd.sock | Exploitation statusActively exploited | FixYes | Published11/20/2025 | SeverityMedium |
|---|
CVE-2025-53882The logrotate configuration in the python-mailman of openSUSE allows the mailman user to sent SIGHUP to arbitrary proceess | Exploitation statusNot exploited | FixYes | Published07/23/2025 | SeverityMedium |
|---|
CVE-2025-23394daily-backup.sh script in cyrus-imapd allows escalation from cyrus to root | Exploitation statusNot exploited | FixYes | Published05/26/2025 | SeverityCritical |
|---|
CVE-2025-23386gerbera: Privilege escalation from user gerbera to root because of insecure %post script | Exploitation statusNot exploited | FixYes | Published04/10/2025 | SeverityHigh |
|---|
CVE-2024-49504grub2 allows bypassing TPM-bound disk encryption on SL(E)M encrypted Images | Exploitation statusNot exploited | FixYes | Published11/13/2024 | SeverityHigh |
|---|
CVE-2024-22034Crafted projects can overwrite special files in the .osc config directory | Exploitation statusNot exploited | FixYes | Published10/16/2024 | SeverityMedium |
|---|
CVE-2024-22033obs-service-download_url is vulnerable to argument injection | Exploitation statusNot exploited | FixYes | Published10/16/2024 | SeverityMedium |
|---|
CVE-2024-22029tomcat packaging allows for escalation to root from tomcat user | Exploitation statusNot exploited | FixYes | Published10/16/2024 | SeverityHigh |
|---|
CVE-2023-32190mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable | Exploitation statusNot exploited | FixYes | Published10/16/2024 | SeverityHigh |
|---|
11 Results | Page 1 of 1