SUSE openSUSE Tumbleweed
11 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-59674 | ? – < 8.0.5-2.1 | LPE from suricata user to root due to chown in %post in suricata packaging | HIGH 7.1 | 0.2 % | ||
| CVE-2026-41051 | ? – < 2.0+git.1600444747.83b3644-3.1 | csync2 uses insecure temporary directories when compiled with C99 or later | MEDIUM 5.1 | 0.1 % | ||
| CVE-2025-62875 | ? – < 7.8.0p0-1.1 | Local DoS in OpenSMTPD via UNIX domain socket smtpd.sock | MEDIUM 6.9 | 0.2 % | ||
| CVE-2025-53882 | ? – < 3.3.10-2.1 | The logrotate configuration in the python-mailman of openSUSE allows the mailman user to sent SIGHUP to arbitrary proceess | MEDIUM 4.8 | 0.1 % | ||
| CVE-2025-23394 | ? – < 3.8.4-2.1 | daily-backup.sh script in cyrus-imapd allows escalation from cyrus to root | CRITICAL 9.8 | 0.6 % | ||
| CVE-2025-23386 | ? – < 2.5.0-1.1 | gerbera: Privilege escalation from user gerbera to root because of insecure %post script | HIGH 7.8 | 0.2 % | ||
| CVE-2024-49504 | ? – < 2.12-28.1 | grub2 allows bypassing TPM-bound disk encryption on SL(E)M encrypted Images | HIGH 7.0 | 0.3 % | ||
| CVE-2024-22034 | | Crafted projects can overwrite special files in the .osc config directory | MEDIUM 5.5 | 0.2 % | ||
| CVE-2024-22033 | ? – < 0.2.1-1.1 | obs-service-download_url is vulnerable to argument injection | MEDIUM 5.1 | 0.9 % | ||
| CVE-2024-22029 | | tomcat packaging allows for escalation to root from tomcat user | HIGH 7.8 | 0.2 % | ||
| CVE-2023-32190 | ? – < 0.26-37.1 | mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable | HIGH 8.5 | 0.2 % |