Vulnerabilities of SUSE openSUSE Tumbleweed
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-44950 | fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer | 9.0 Critical | Sep 10, 2026 |
| CVE-2026-59679 | fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array… | 9.0 Critical | Sep 10, 2026 |
| CVE-2026-59674 | A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata… | 7.1 High | Jul 14, 2026 |
| CVE-2026-41051 | csync2 uses insecure temporary directories when compiled with C99 or later, allowing for TOCTOU style attacks on the… | 5.1 Medium | May 13, 2026 |
| CVE-2025-62875 | An Improper Check for Unusual or Exceptional Conditions vulnerability in OpenSMTPD allows local users to crash OpenSMTPD | 6.9 Medium | Nov 20, 2025 |
| CVE-2025-53882 | A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSE mailman3… | 4.4 Medium | Jul 23, 2025 |
| CVE-2025-23394 | A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus… | 9.8 Critical | May 26, 2025 |
| CVE-2025-23386 | A Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed package gerbera allows the service user gerbera… | 7.8 High | Apr 10, 2025 |
| CVE-2024-49504 | grub2 allowed attackers with access to the grub shell to access files on the encrypted disks | 7.0 High | Nov 13, 2024 |
| CVE-2024-22034 | Attackers could put the special files in .osc into the actual package sources (e.g | 5.5 Medium | Oct 16, 2024 |
| CVE-2024-22033 | The OBS service obs-service-download_url was vulnerable to a command injection vulnerability | 6.3 Medium | Oct 16, 2024 |
| CVE-2024-22029 | Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to… | 7.8 High | Oct 16, 2024 |
| CVE-2023-32190 | mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable by abusing insecure file… | 8.5 High | Oct 16, 2024 |
Other SUSE products
Rancher 86
neuvector 14
SUSE Linux Enterprise Server 15 13
SUSE Linux Enterprise Server 12 12
SUSE Linux Enterprise Server for SAP 15 8
libzypp 7
SUSE Linux Enterprise Server 15-LTSS 7
SUSE Manager Server Module 4.3 7
SUSE Linux Enterprise Server for SAP Applications 15 SP6 6
supportutils 5
SUSE Linux Enterprise Server for SAP Applications 15 SP5 5
openSUSE Factory 5