Skip to content
OpenAdvisories

Source

SUSE / openSUSE Security Updates

Source: https://www.suse.com/support/update/

All Critical High Medium Low With exploited CVEs

12,597 results · Clear filters · Feed

  • High max 8.0
    openSUSE-SU-2026:21208-1 1 CVE

    Security update for cockpit

    This update for cockpit fixes the following issue - CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs UI (bsc#1265040).

    first Jul 2, 2026
  • High max 7.5
    openSUSE-SU-2026:11179-1 1 CVE

    perl-List-SomeUtils-XS-0.590.0-1.1 on GA media

    These are all security issues fixed in the perl-List-SomeUtils-XS-0.590.0-1.1 package on the GA media of openSUSE Tumbleweed.

    first Jul 2, 2026
  • High max 8.7
    openSUSE-SU-2026:11178-1 3 CVEs

    openQA-5.1782995932.ffeb09be-1.1 on GA media

    These are all security issues fixed in the openQA-5.1782995932.ffeb09be-1.1 package on the GA media of openSUSE Tumbleweed.

    first Jul 2, 2026
  • High max 7.5
    openSUSE-SU-2026:11176-1 1 CVE

    kitty-0.47.4-2.1 on GA media

    These are all security issues fixed in the kitty-0.47.4-2.1 package on the GA media of openSUSE Tumbleweed.

    first Jul 2, 2026
  • High max 8.8
    openSUSE-SU-2026:11175-1 4 CVEs

    kernel-devel-7.1.2-1.1 on GA media

    These are all security issues fixed in the kernel-devel-7.1.2-1.1 package on the GA media of openSUSE Tumbleweed.

    first Jul 2, 2026
  • High max 7.5
    openSUSE-SU-2026:11173-1 2 CVEs

    etcd-3.6.13-1.1 on GA media

    These are all security issues fixed in the etcd-3.6.13-1.1 package on the GA media of openSUSE Tumbleweed.

    first Jul 2, 2026
  • High max 8.6
    SUSE-SU-2026:2727-1 2 CVEs

    Security update for gstreamer-plugins-good

    This update for gstreamer-plugins-good fixes the following issues - CVE-2024-47540: uninitialized stack memory in Matroska/WebM demuxer (bsc#1234421). - CVE-2026-53705: Heap buffer overflow in WavPack decoder via integer overflow (bsc#1268449).

    first Jul 2, 2026
  • High max 7.7
    SUSE-SU-2026:2726-1 3 CVEs

    Security update for python-tornado

    This update for python-tornado fixes the following issues - CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395). - CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396). - CVE…

    first Jul 2, 2026
  • High max 7.7
    SUSE-SU-2026:2725-1 3 CVEs

    Security update for python-tornado6

    This update for python-tornado6 fixes the following issues - CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395). - CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396). - CV…

    first Jul 2, 2026
  • High max 7.8
    openSUSE-SU-2026:21185-1 1 CVE

    Security update for stgit

    This update for stgit fixes the following issues: Changes in stgit: - Update to version 2.6.0: * chore: update changelog for 2.6.0 * fix(import): respect --name verbatim, ignoring stgit.namelength * test(refresh): use test_when_finished for status.renames cle…

    first Jun 30, 2026
  • High max 7.7
    openSUSE-SU-2026:21184-1 2 CVEs

    Security update for coturn

    This update for coturn fixes the following issues: Changes in coturn: - Update to version 4.14.0 New * No more dependency on prometheus-client-c * HTTPS support for prometheus client (optional) * TLS support for redis - now compatible with managed redis (opti…

    first Jun 30, 2026
  • High max 7.5
    openSUSE-SU-2026:21182-1 2 CVEs

    Security update for python-python-engineio

    This update for python-python-engineio fixes the following issues: Changes in python-python-engineio: - CVE-2026-48802: remote user can cause the creation of unnecessary background threads in the server through the heartbeat mechanism and cause a DoS (bsc#126…

    first Jun 30, 2026
  • High max 7.5
    openSUSE-SU-2026:21180-1 2 CVEs

    Security update for mupdf

    This update for mupdf fixes the following issues: Changes in mupdf: - Build and ship MuPDF as a shared library (make shared=yes) instead of static-only: * New subpackage libmupdf27_2 carries libmupdf.so.27.2 (the SONAME tracks the upstream minor.patch version…

    first Jun 30, 2026
  • High max 7.3
    openSUSE-SU-2026:21177-1 2 CVEs

    Security update for perl-IO-Compress

    This update for perl-IO-Compress fixes the following issues: Changes in perl-IO-Compress: - updated to 2.220.0 (2.220) see /usr/share/doc/packages/perl-IO-Compress/Changes 2.220 16 May 2026 * remove use of eval in globmapper. #73 CVE-2026-48962 bsc#1266382 * …

    first Jun 30, 2026
  • High max 7.5
    openSUSE-SU-2026:21176-1 2 CVEs

    Security update for python-pytest-html

    This update for python-pytest-html fixes the following issues: Changes in python-pytest-html: - Revendor updating shell-quote and js-yaml deps: - CVE-2026-13311: shell-quote: inefficient input parsing can lead to a denial of service (bsc#1269361) - CVE-2026-5…

    first Jun 30, 2026
  • High max 7.5
    openSUSE-SU-2026:11171-1 1 CVE

    python311-python-socketio-5.16.3-1.1 on GA media

    These are all security issues fixed in the python311-python-socketio-5.16.3-1.1 package on the GA media of openSUSE Tumbleweed.

    first Jul 1, 2026
  • High max 7.5
    openSUSE-SU-2026:11170-1 1 CVE

    python311-python-engineio-4.13.3-1.1 on GA media

    These are all security issues fixed in the python311-python-engineio-4.13.3-1.1 package on the GA media of openSUSE Tumbleweed.

    first Jul 1, 2026
  • High max 8.2
    SUSE-SU-2026:22382-1 1 CVE

    Security update for giflib

    This update for giflib fixes the following issue - CVE-2026-26740: heap out-of-bounds read when processing a specially crafted GIF file containing a GCE block with a truncated extension byte count (bsc#1259836).

    first Jun 28, 2026
  • High max 7.5
    SUSE-SU-2026:22378-1 32 CVEs

    Security update for ImageMagick

    This update for ImageMagick fixes the following issues Security issues: - CVE-2026-42050: Stack buffer overflow in XTileImage (bsc#1265048). - CVE-2026-42326: Information disclosure via malicious IPTC input file (bsc#1268092). - CVE-2026-45031: Denial of Serv…

    first Jun 26, 2026
  • High max 7.7
    SUSE-SU-2026:22373-1 3 CVEs

    Security update for python-tornado6

    This update for python-tornado6 fixes the following issues - CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395). - CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396). - CV…

    first Jun 26, 2026
  • High max 7.5
    SUSE-SU-2026:22372-1 4 CVEs

    Security update for python-python-multipart

    This update for python-python-multipart fixes the following issues - CVE-2026-53537: multipart/form-data with extended parameters can lead to file or parameter smuggling (bsc#1268506). - CVE-2026-53538: urlencoded requests containing semicolons can lead to fo…

    first Jun 26, 2026
  • High max 7.6
    SUSE-SU-2026:22369-1 4 CVEs

    Security update for libaom

    This update for libaom fixes the following issues - CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a process crash (bsc#1268650). - CVE-2026-56209: crafted video frames with specific Y-plane pixel values ca…

    first Jun 25, 2026
  • High max 7.7
    SUSE-SU-2026:22368-1 26 CVEs

    Security update for nodejs22

    This update for nodejs22 fixes the following issues Update to 22.23.0: - CVE-2026-6733: undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery (bsc#1268479). - CVE-2026-9496: pacote: excessive CPU consump…

    first Jun 25, 2026
  • High max 8.1
    SUSE-SU-2026:22364-1 2 CVEs

    Security update for libssh2_org

    This update for libssh2_org fixes the following issues - CVE-2026-55199: pre-Authentication DoS via SSH_MSG_EXT_INFO Handler (bsc#1268530). - CVE-2026-55200: out-of-Bounds write via Unchecked packet_length in transport.c (bsc#1268531).

    first Jun 25, 2026
  • High max 7.1
    SUSE-SU-2026:22363-1 1 CVE

    Security update for libnfs

    This update for libnfs fixes the following issue - CVE-2026-53689: integer overflow during a connection to a crafted NFS server (bsc#1268135).

    first Jun 25, 2026
  • High max 7.5
    SUSE-SU-2026:22358-1 1 CVE

    Security update for dracut

    This update for dracut fixes the following issue - CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322). Changes for dracut: - Update to version 059+suse.722.gdd9d67ff5: * fix(network-legacy): sanitize DHCP values in dhclient-sc…

    first Jun 24, 2026
  • High max 7.5
    SUSE-SU-2026:22360-1 3 CVEs

    Security update for python-starlette

    This update for python-starlette fixes the following issues - CVE-2026-48817: arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` (bsc#1268389). - CVE-2026-54282: request path that lacks a leading forward slash can lead to request.url.…

    first Jun 24, 2026
  • High max 8.8
    SUSE-SU-2026:22347-1 8 CVEs

    Security update for 7zip

    This update for 7zip fixes the following issues Update to 26.01: - CVE-2026-48092: Information disclosure in 32-bit builds due to heap memory disclosure (bsc#1267858). - CVE-2026-48095: Heap buffer overflow via NTFS compressed stream buffer under-allocation (…

    first Jun 23, 2026
  • High max 8.6
    SUSE-SU-2026:22329-1 1 CVE

    Security update for perl-Config-IniFiles

    This update for perl-Config-IniFiles fixes the following issue - CVE-2026-11527: OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle (bsc#1268236).

    first Jun 22, 2026
  • High max 7.4
    SUSE-SU-2026:22324-1 3 CVEs

    Security update for libexif

    This update for libexif fixes the following issues - CVE-2026-32775: Buffer overwrite via integer underflow in MakerNotes decoding (bsc#1259755). - CVE-2026-40385: information disclosure and crashes via integer overflow in Nikon MakerNote handling (bsc#126200…

    first Jun 22, 2026
  • High max 7.2
    SUSE-SU-2026:22321-1 1 CVE

    Security update for python-click

    This update for python-click fixes the following issue - CVE-2026-7246: Arbitrary command execution via command injection in click.edit() (bsc#1263898).

    first Jun 22, 2026
  • High max 7.5
    SUSE-SU-2026:22319-1 18 CVEs

    Security update for dnsdist

    This update for dnsdist fixes the following issues - CVE-2026-0396: crafted DNS queries can allow to inject HTML content (bsc#1261236). - CVE-2026-0397: CORS misconfiguration can lead to information disclosure (bsc#1261237). - CVE-2026-24028: crafted DNS resp…

    first Jun 22, 2026
  • High max 7.5
    SUSE-SU-2026:22313-1 1 CVE

    Security update for gsasl

    This update for gsasl fixes the following issues: Changes in gsasl: - CVE-2026-48829: DIGEST-MD5: Fix NULL pointer dereference in parser (bsc#1266371)

    first Jun 22, 2026
  • High max 7.8
    SUSE-SU-2026:22306-1 8 CVEs

    Security update for tiff

    This update for tiff fixes the following issues Security issues: - CVE-2025-8851: libtiff: LibTIFF Stack-based buffer overflow (bsc#1248278). - CVE-2026-4775: signed integer overflow in the `putcontig8bitYCbCr44tile` function (bsc#1260411). Non security issue…

    first Jun 21, 2026
  • High max 7.3
    SUSE-SU-2026:22294-1 1 CVE

    Security update for ncurses

    This update for ncurses fixes the following issue: - CVE-2025-69720: buffer overflow in function `analyze_string()`of `progs/infocmp.c` (bsc#1259924).

    first Jun 20, 2026
  • High max 7.5
    SUSE-SU-2026:2721-1 1 CVE

    Security update for dracut

    This update for dracut fixes the following issue - CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322). Changes for dracut: - Update to version 055+suse.402.g2720eea: * fix(network-legacy): sanitize DHCP values in dhclient-scri…

    first Jul 1, 2026
  • High max 7.5
    SUSE-SU-2026:2720-1 1 CVE

    Security update for dracut

    This update for dracut fixes the following issue - CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322). Changes for dracut: - Update to version 055+suse.365.g79144c5: * fix(network-legacy): sanitize DHCP values in dhclient-scri…

    first Jul 1, 2026
  • High max 8.6
    SUSE-SU-2026:2719-1 1 CVE

    Security update for pacemaker

    This update for pacemaker fixes the following issues: - CVE-2026-10649: Fixed denial-of-service via integer overflow in remote message decompression (bsc#1268381). Changes for pacemaker: - Update to version 2.1.10+20260618.4bca25e3c1: - libcrmcommon: Add addi…

    first Jul 1, 2026
  • High max 7.7
    openSUSE-SU-2026:11161-1 1 CVE

    radvd-2.21-1.1 on GA media

    These are all security issues fixed in the radvd-2.21-1.1 package on the GA media of openSUSE Tumbleweed.

    first Jun 30, 2026
  • High max 8.4
    openSUSE-SU-2026:11163-1 1 CVE

    libxreaderdocument3-4.6.5-1.1 on GA media

    These are all security issues fixed in the libxreaderdocument3-4.6.5-1.1 package on the GA media of openSUSE Tumbleweed.

    first Jun 30, 2026