Vulnerabilities of SUSE libzypp

Is your version affected?

CVE	Summary	Score	Published
CVE-2026-44941	A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by…	8.4 High	Jul 2, 2026
CVE-2026-25707	A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by…	8.8 High	Jun 29, 2026
CVE-2026-44942	A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x…	6.5 Medium	Jun 18, 2026
CVE-2018-7685	The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the…	7.8 High	Aug 31, 2018
CVE-2017-9269	In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious…	7.7 High	Mar 1, 2018
CVE-2017-7436	In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could…	8.1 High	Mar 1, 2018
CVE-2017-7435	In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could…	8.1 High	Mar 1, 2018