en
SUSE is a provider of enterprise open source software for Linux, Kubernetes, cloud native infrastructure, edge computing, security, storage, observability, and AI. Its offerings support organizations running hybrid, distributed, and mission-critical workloads through commercial subscriptions, support, and open source technologies.
As of 11/13/2026, SUSE recorded 39 security vulnerabilities in the last 90 days across 44 products, including 23 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Rancher had the most security vulnerabilities in the SUSE ecosystem, with 19 vulnerabilities—approximately 48.72% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2017-14807SQL injection in ui-server/app/models/diary_entry.rb in SUSE Studio onsiteCVE-2017-14806Insecure handling of repodata and packages in SUSE Studio onliteCVE-2019-3693Local privilege escalation from user wwwrun to root in the packaging of mailmanCVE-2019-3692Local privilege escalation from user news to root in the packaging of innCVE-2019-3687"easy" permission profile allows everyone execute dumpcap and read all network traffic| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2017-14807SQL injection in ui-server/app/models/diary_entry.rb in SUSE Studio onsite | Exploitation statusNot confirmed | FixNo |
| Published01/27/2020 |
| SeverityHigh |
CVE-2017-14806Insecure handling of repodata and packages in SUSE Studio onlite | Exploitation statusNot confirmed | FixNo | Affected productStudio onsite | Published01/27/2020 | SeverityLow |
|---|
CVE-2019-3693Local privilege escalation from user wwwrun to root in the packaging of mailman | Exploitation statusNot confirmed | FixYes | Affected productLeap 15.1 | Published01/24/2020 | SeverityHigh |
|---|
CVE-2019-3692Local privilege escalation from user news to root in the packaging of inn | Exploitation statusNot confirmed | FixNo | Affected productFactory | Published01/24/2020 | SeverityHigh |
|---|
CVE-2019-3687"easy" permission profile allows everyone execute dumpcap and read all network traffic | Exploitation statusNot confirmed | FixYes | Affected productSUSE Linux Enterprise Server | Published01/24/2020 | SeverityMedium |
|---|
CVE-2019-18900libzypp stores cookies world readable | Exploitation statusNot confirmed | FixYes | Affected productCaaS Platform 3.0 | Published01/24/2020 | SeverityMedium |
|---|
CVE-2019-3691Local privilege escalation from user munge to root | Exploitation statusNot confirmed | FixYes | Affected productFactory | Published01/23/2020 | SeverityHigh |
|---|
CVE-2019-18898trousers: Local privilege escalation from tss to root | Exploitation statusNot confirmed | FixYes | Affected productFactory | Published01/23/2020 | SeverityHigh |
|---|
CVE-2019-3683keystone_json_assignment backend granted access to any project for users in user-project-map.json | Exploitation statusNot confirmed | FixYes | Affected productSUSE OpenStack Cloud 8 | Published01/17/2020 | SeverityHigh |
|---|
CVE-2019-3688squid: /usr/sbin/pinger packaged with wrong permission | Exploitation statusNot confirmed | FixNo | Affected productSUSE Linux Enterprise Server 12 | Published10/07/2019 | SeverityMedium |
|---|
CVE-2019-3689nfs-utils: root-owned files stored in insecure /var/lib/nfs directory | Exploitation statusNot confirmed | FixNo | Affected productSUSE Linux Enterprise Server 12 | Published09/19/2019 | SeverityMedium |
|---|
CVE-2018-7685libzypp does not reevaluate malicious rpms once downloaded | Exploitation statusNot confirmed | FixYes | Affected productlibzypp | Published08/31/2018 | SeverityHigh |
|---|
CVE-2011-4183open build service allows anyone to upload rpms | Exploitation statusNot confirmed | FixYes | Affected productopen build service | Published06/13/2018 | SeverityMedium |
|---|
CVE-2011-4181open build service information leak via unauthorized source access | Exploitation statusNot confirmed | FixYes | Affected productopen build service | Published06/11/2018 | SeverityMedium |
|---|
CVE-2011-3172unix2_chkpwd do not check for a valid account | Exploitation statusNot confirmed | FixYes | Affected productSUSE Linux Enterprise | Published06/08/2018 | SeverityMedium |
|---|
CVE-2011-0467SQL injection in SUSE studio via select parameter | Exploitation statusNot confirmed | FixYes | Affected productSUSE Studio Onsite | Published06/07/2018 | SeverityHigh |
|---|
CVE-2015-0796open build service source server symlink exploitation via source patch | Exploitation statusNot confirmed | FixYes | Affected productopen build service | Published03/02/2018 | SeverityMedium |
|---|
CVE-2017-9269lack of keypinning in libzypp could lead to repository switching | Exploitation statusNot confirmed | FixYes | Affected productlibzypp | Published03/01/2018 | SeverityHigh |
|---|
CVE-2017-9268open-build-service retrigger / wipebinaries hitting the wrong project bypassing access permissions | Exploitation statusNot confirmed | FixYes | Affected productopen build service | Published03/01/2018 | SeverityMedium |
|---|
CVE-2017-7436libzypp accepts unsigned packages even when configured to check signatures | Exploitation statusNot confirmed | FixYes | Affected productlibzypp | Published03/01/2018 | SeverityHigh |
|---|
CVE-2017-7435libzypp accepts unsigned 3rd party repo without warning | Exploitation statusNot confirmed | FixYes | Affected productlibzypp | Published03/01/2018 | SeverityHigh |
|---|
CVE-2017-14804package builds could use directory traversal to write outside of target area | Exploitation statusNot confirmed | FixNo | Affected productbuild | Published03/01/2018 | SeverityCritical |
|---|
CVE-2017-14798local privilege escalation in SUSE postgresql init script | Exploitation statusActively exploited | FixYes | Affected productpostgresql-init | Published03/01/2018 | SeverityHigh |
|---|
CVE-2015-3306CVE-2015-3306 | Exploitation statusKEV | FixNo | Affected productdebian_linux | Published05/18/2015 | SeverityCritical |
|---|
CVE-2014-7169Incomplete function parsing in GNU Bash enables crafted-environment file writes | Exploitation statusKEV | FixYes | Affected producteos | Published09/25/2014 | SeverityCritical |
|---|
CVE-2014-6271Environment-variable command injection enables arbitrary code execution in GNU Bash | Exploitation statusKEV | FixYes | Affected producteos | Published09/24/2014 | SeverityCritical |
|---|
226 Results | Page 5 of 5