Vulnerabilities of SUSE neuvector
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-78424 | Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write)… | 8.8 High | Sep 28, 2026 |
| CVE-2026-78426 | The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field | 2.0 Low | Sep 17, 2026 |
| CVE-2026-78428 | For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving… | 8.8 High | Sep 17, 2026 |
| CVE-2025-46808 | An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive… | 6.8 Medium | Sep 9, 2026 |
| CVE-2026-25703 | NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing… | 7.3 High | Aug 5, 2026 |
| CVE-2025-66001 | NeuVector supports login authentication through OpenID Connect | 8.8 High | Jan 8, 2026 |
| CVE-2025-54471 | NeuVector used a hard-coded cryptographic key embedded in the source code | 6.5 Medium | Oct 30, 2025 |
| CVE-2025-54469 | A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and… | 9.9 Critical | Oct 30, 2025 |
| CVE-2025-54470 | This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled | 8.6 High | Oct 30, 2025 |
| CVE-2025-8077 | A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default… | 9.8 Critical | Sep 17, 2025 |
| CVE-2025-54467 | When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation the… | 5.3 Medium | Sep 17, 2025 |
| CVE-2025-53884 | NeuVector stores user passwords and API keys using a simple, unsalted hash | 5.3 Medium | Sep 17, 2025 |
| CVE-2023-32188 | A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging… | 9.4 Critical | Oct 16, 2024 |
| CVE-2023-22644 | A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging… | 9.4 Critical | Sep 20, 2023 |
Other SUSE products
Rancher 86
SUSE Linux Enterprise Server 15 13
openSUSE Tumbleweed 13
SUSE Linux Enterprise Server 12 12
SUSE Linux Enterprise Server for SAP 15 8
libzypp 7
SUSE Linux Enterprise Server 15-LTSS 7
SUSE Manager Server Module 4.3 7
SUSE Linux Enterprise Server for SAP Applications 15 SP6 6
supportutils 5
open build service 5
SUSE Linux Enterprise Server for SAP Applications 15 SP5 5