openSUSE leap vulnerabilities

Latest openSUSE leap CVEs

Newest publication first · page 1 of 40 · showing the latest 1,000

1. CVE-2026-31431 crypto: algif_aead - Revert to operating out-of-place

   Published 2026-04-22

   High·CVSS 7.8 EPSS 98.1% CISA KEV added 2026-05-01 Exploited in the wild Framework module

   In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the sourc...

2. CVE-2025-32463 Sudo before 1.9.17p1 allows local users to obtain root access

   Published 2025-06-30

   High·CVSS 7.8 EPSS 56.3% CISA KEV added 2025-09-29 Exploited in the wild Framework module Public exploit

   Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

3. CVE-2023-32182 A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise High Performance Computing 15 SP5 postfi...

   Published 2023-09-19

   High·CVSS 7.8 EPSS 0.30%

   A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SUSE Linux Enterprise High Performance Computing 15 SP5 postfix, SUSE openSUSE Leap 15.5 postfix.This issue affects SUSE Linux Enterprise Desk...

4. CVE-2022-45153 saphanabootstrap-formula: Escalation to root for arbitrary users in hana/ha_cluster.sls

   Published 2023-02-15

   High·CVSS 7.8 EPSS 0.22%

   An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise Server for SAP 12-SP5; openSUSE Leap 15.4 allows local attackers to escalate to root by manipulating the sudo configuratio...

5. CVE-2022-31252 permissions: chkstat does not check for group-writable parent directories or target files in safeOpen()

   Published 2022-10-06

   Medium·CVSS 4.4 EPSS 0.15%

   A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did not consider group writable path components, allowing local attackers with access to a group what can write to a location...

6. CVE-2021-46141 An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriFreeUriMembers and uriMakeOwner.

   Published 2022-01-06

   Medium·CVSS 5.5 EPSS 1.2%

   An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriFreeUriMembers and uriMakeOwner.

7. CVE-2021-46142 An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.

   Published 2022-01-06

   Medium·CVSS 5.5 EPSS 1.2%

   An issue was discovered in uriparser before 0.9.6. It performs invalid free operations in uriNormalizeSyntax.

8. CVE-2021-41817 Regular expression denial of service vulnerability (ReDoS) in date

   Published 2022-01-01

   High·CVSS 7.5 EPSS 3.5% PoC

   Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.

9. CVE-2021-41819 Cookie Prefix Spoofing in CGI::Cookie.parse

   Published 2022-01-01

   High·CVSS 7.5 EPSS 3.2% PoC

   CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

10. CVE-2021-26676 gdhcp in ConnMan before 1.39 could be used by network-adjacent attackers to leak sensitive stack information, allowing further exploitation of bugs in gdhcp.

    Published 2021-02-09

    Medium·CVSS 6.5 EPSS 1.2%

    gdhcp in ConnMan before 1.39 could be used by network-adjacent attackers to leak sensitive stack information, allowing further exploitation of bugs in gdhcp.

11. CVE-2021-26675 A stack-based buffer overflow in dnsproxy in ConnMan before 1.39 could be used by network adjacent attackers to execute code.

    Published 2021-02-09

    High·CVSS 8.8 EPSS 1.4%

    A stack-based buffer overflow in dnsproxy in ConnMan before 1.39 could be used by network adjacent attackers to execute code.

12. CVE-2020-0569 Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated user to potentially enable denial of service via local access.

    Published 2020-11-23

    Medium·CVSS 5.7 EPSS 0.52%

    Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated user to potentially enable denial of service via local access.

13. CVE-2020-16846 SaltStack Salt Command Injection in netapi ssh client

    Published 2020-11-06

    Critical·CVSS 9.8 EPSS 99.6% CISA KEV added 2021-11-03 Exploited in the wild Framework module Public exploit PoC

    An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

14. CVE-2020-28049 An issue was discovered in SDDM before 0.19.0. It incorrectly starts the X server in a way that - for a short time period - allows local unprivileged users to create a connection to the X server witho...

    Published 2020-11-04

    Medium·CVSS 6.3 EPSS 0.42%

    An issue was discovered in SDDM before 0.19.0. It incorrectly starts the X server in a way that - for a short time period - allows local unprivileged users to create a connection to the X server without providing proper authentication. A local attacker can thus access X server di...

15. CVE-2020-16011 Heap buffer overflow in UI in Google Chrome on Windows prior to 86.0.4240.183 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted H...

    Published 2020-11-03

    Critical·CVSS 9.6 EPSS 2.4%

    Heap buffer overflow in UI in Google Chrome on Windows prior to 86.0.4240.183 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

16. CVE-2020-16009 Inappropriate implementation in V8

    Published 2020-11-03

    High·CVSS 8.8 EPSS 48.3% CISA KEV added 2021-11-03 Exploited in the wild Public exploit

    Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

17. CVE-2020-16007 Insufficient data validation in installer in Google Chrome prior to 86.0.4240.183 allowed a local attacker to potentially elevate privilege via a crafted filesystem.

    Published 2020-11-03

    High·CVSS 7.8 EPSS 0.27%

    Insufficient data validation in installer in Google Chrome prior to 86.0.4240.183 allowed a local attacker to potentially elevate privilege via a crafted filesystem.

18. CVE-2020-16008 Stack buffer overflow in WebRTC in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit stack corruption via a crafted WebRTC packet.

    Published 2020-11-03

    High·CVSS 8.8 EPSS 1.2%

    Stack buffer overflow in WebRTC in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit stack corruption via a crafted WebRTC packet.

19. CVE-2020-16006 Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

    Published 2020-11-03

    High·CVSS 8.8 EPSS 1.7%

    Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

20. CVE-2020-16005 Insufficient policy enforcement in ANGLE in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

    Published 2020-11-03

    High·CVSS 8.8 EPSS 1.7%

    Insufficient policy enforcement in ANGLE in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

21. CVE-2020-16004 Use after free in user interface in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

    Published 2020-11-03

    High·CVSS 8.8 EPSS 1.5%

    Use after free in user interface in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

22. CVE-2020-14323 A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing....

    Published 2020-10-29

    Medium·CVSS 5.5 EPSS 0.62%

    A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of service.

23. CVE-2020-27670 An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because an AMD IOMMU page-table...

    Published 2020-10-22

    High·CVSS 7.8 EPSS 0.25%

    An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because an AMD IOMMU page-table entry can be half-updated.

24. CVE-2020-27671 An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because coalescing....

    Published 2020-10-22

    High·CVSS 7.8 EPSS 0.34%

    An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because coalescing of per-page IOMMU TLB flushes is mishandled.

25. CVE-2020-27672 An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of service, achieve data corruption, or possibly gain privileges by exploiting a race condition that...

    Published 2020-10-22

    High·CVSS 7.0 EPSS 0.26%

    An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of service, achieve data corruption, or possibly gain privileges by exploiting a race condition that leads to a use-after-free involving 2MiB and 1GiB superpages.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.