Skip to content
OpenAdvisories

Source

SUSE / openSUSE Security Updates

Source: https://www.suse.com/support/update/

All Critical High Medium Low With exploited CVEs

35,648 results · Feed

  • High max 8.8
    SUSE-SU-2026:1248-1 6 CVEs

    Security update for the Linux Kernel (Live Patch 28 for SUSE Linux Enterprise 15 SP5)

    This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.113 fixes various security issues The following security issues were fixed: - CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252036). - CVE-2025-40018: ipvs: Defer ip_vs_ftp unr…

    first Apr 10, 2026
  • High max 7.5
    SUSE-SU-2026:1247-1 1 CVE

    Security update for nghttp2

    This update for nghttp2 fixes the following issue: - CVE-2026-27135: assertion failure due to missing state validation can lead to DoS (bsc#1259845).

    first Apr 10, 2026
  • Critical max 9.2
    SUSE-SU-2026:1250-1 2 CVEs

    Security update for cockpit-tukit

    This update for cockpit-tukit fixes the following issues: - CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and may crash a Node.js process (bsc#1257836). - CVE-2026-26996: minimatch: ReDoS whe…

    first Apr 10, 2026
  • Critical max 9.6
    openSUSE-SU-2026:10529-1 2 CVEs

    tekton-cli-0.44.1-1.1 on GA media

    These are all security issues fixed in the tekton-cli-0.44.1-1.1 package on the GA media of openSUSE Tumbleweed.

    first Apr 10, 2026
  • Critical max 9.2
    SUSE-SU-2026:1249-1 2 CVEs

    Security update for cockpit-machines

    This update for cockpit-machines fixes the following issues: - CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and may crash a Node.js process (bsc#1257836). - CVE-2026-26996: minimatch: ReDoS …

    first Apr 10, 2026
  • High max 8.8
    SUSE-SU-2026:1242-1 6 CVEs

    Security update for the Linux Kernel (Live Patch 27 for SUSE Linux Enterprise 15 SP5)

    This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.110 fixes various security issues The following security issues were fixed: - CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252036). - CVE-2025-40018: ipvs: Defer ip_vs_ftp unr…

    first Apr 10, 2026
  • High max 7.5
    openSUSE-SU-2026:20468-1 2 CVEs

    Security update for python-cbor2

    This update for python-cbor2 fixes the following issues: - CVE-2025-68131: CBORDecoder reuse across trust boundaries can lead to leak of shareable values from previous decode calls via attacker-controlled messages (bsc#1255783). - CVE-2026-26209: uncontrolled…

    first Apr 7, 2026
  • High max 7.6
    openSUSE-SU-2026:20466-1 2 CVEs

    Security update for libpng16

    This update for libpng16 fixes the following issues: - CVE-2026-33416: use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE` can lead to arbitrary code execution (bsc#1260754). - CVE-2026-33636: out-of-bounds read/write in the palette expan…

    first Apr 7, 2026
  • High max 8.7
    openSUSE-SU-2026:20464-1 1 CVE

    Security update for cockpit-repos

    This update for cockpit-repos fixes the following issue: - CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character that doesn't appear in the test string (bsc#1258637).

    first Apr 5, 2026
  • High max 8.6
    SUSE-SU-2026:20992-1 1 CVE

    Security update for python-Pillow

    This update for python-Pillow fixes the following issues: - CVE-2026-25990: Fixed an out-of-bounds write when opening a specially crafted PSD image. (bsc#1258125)

    first Apr 1, 2026
  • Medium max 4.0
    SUSE-SU-2026:20985-1 3 CVEs

    Security update for expat

    This update for expat fixes the following issues: - CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726). - CVE-2026-32777: denial of service due to infinite loop in DTD co…

    first Mar 30, 2026
  • Critical max 9.6
    SUSE-SU-2026:20982-1 6 CVEs

    Security update for tomcat10

    This update for tomcat10 fixes the following issues: Update to Tomcat 10.1.52: - CVE-2025-55752: directory traversal via rewrite with possible RCE if PUT is enabled (bsc#1252753). - CVE-2025-55754: Improper Neutralization of Escape, Meta, or Control Sequences…

    first Mar 30, 2026
  • High max 8.7
    SUSE-SU-2026:20997-1 1 CVE

    Security update for cockpit-repos

    This update for cockpit-repos fixes the following issue: - CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character that doesn't appear in the test string (bsc#1258637).

    first Apr 5, 2026
  • High max 7.5
    SUSE-SU-2026:20995-1 2 CVEs

    Security update for dnsdist

    This update for dnsdist fixes the following issues: Update to dnsdist 1.9.11: - CVE-2025-8671: add mitigations for the HTTP/2 MadeYouReset attack (bsc#1253852). - CVE-2025-30187: denial of service via crafted DoH exchange (bsc#1250054).

    first Apr 2, 2026
  • Medium max 4.3
    SUSE-SU-2026:20988-1 2 CVEs

    Security update for gnome-online-accounts, gvfs

    This update for gnome-online-accounts, gvfs fixes the following issues: Changes for gvfs: Update gvfs to 1.59.90: - CVE-2026-28295: information disclosure when processing untrusted PASV responses from FTP servers (bsc#1258953). - CVE-2026-28296: arbitrary FTP…

    first Mar 31, 2026
  • Critical max 10.0
    SUSE-SU-2026:20978-1 38 CVEs

    Security update for MozillaFirefox

    This update for MozillaFirefox fixes the following issues: Update to Firefox 140.9.0 ESR (MFSA 2026-22, bsc#1260083): - CVE-2026-4684: Race condition, use-after-free in the Graphics: WebRender component - CVE-2026-4685: Incorrect boundary conditions in the Gr…

    first Mar 27, 2026
  • High max 8.9
    SUSE-SU-2026:20976-1 3 CVEs

    Security update for docker-compose

    This update for docker-compose fixes the following issues: - CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253584). - CVE-2025-47914: g…

    first Mar 27, 2026
  • High max 8.8
    SUSE-FU-2026:20990-1 4 CVEs

    Feature update for himmelblau

    This update for himmelblau fixes the following issues: Update to himmelblau 2.3.8 (jsc#PED-14511): Security issues: - CVE-2025-54882: world readable cloud TGT token (bsc#1247735). - CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249013). - CV…

    first Apr 1, 2026
  • Critical max 9.8
    SUSE-SU-2026:20993-1 2 CVEs

    Security update for perl-XML-Parser

    This update for perl-XML-Parser fixes the following issues: - CVE-2006-10002: heap buffer overflow in `parse_stream` when processing UTF-8 input streams (bsc#1259901). - CVE-2006-10003: off-by-one heap buffer overflow in `st_serial_stack` (bsc#1259902).

    first Apr 1, 2026
  • High max 7.5
    SUSE-SU-2026:20989-1 2 CVEs

    Security update for kea

    This update for kea fixes the following issues: Update to 3.0.3: - CVE-2025-11232: invalid characters cause assert (bsc#1252863). - CVE-2026-3608: stack overflow via maliciously crafted message (bsc#1260380). Changelog: * A large number of bracket pairs in a …

    first Apr 1, 2026
  • High max 8.8
    SUSE-SU-2026:20983-1 4 CVEs

    Security update for postgresql16

    This update for postgresql16 fixes the following issues: - Update to versio 16.13. (bsc#1258754) - CVE-2026-2003: Guard against unexpected dimensions of oidvector/int2vector (bsc#1258008) - CVE-2026-2004: Harden selectivity estimators against being attached t…

    first Mar 30, 2026
  • Critical max 9.8
    openSUSE-SU-2026:20473-1 1 CVE

    Security update for osslsigncode

    This update for osslsigncode fixes the following issues: Changes in osslsigncode: - Update to 2.13 (bsc#1260680, CVE-2025-70888): * fixed integer overflows when processing APPX compressed data streams * fixed double-free vulnerabilities in APPX file processin…

    first Apr 7, 2026
  • High max 7.5
    openSUSE-SU-2026:20477-1 1 CVE

    Security update for aws-c-event-stream

    This update for aws-c-event-stream fixes the following issues: Changes in aws-c-event-stream: - CVE-2026-5190: Fixed a out-of-bounds write caused by crafted event-stream messages (bsc#1261298)

    first Apr 8, 2026
  • Medium max 6.7
    openSUSE-SU-2026:20471-1 2 CVEs

    Security update for systemd

    This update for systemd fixes the following issues: Update to systemd v257.13: Security issues: - CVE-2026-4105: privilege escalation due to improper access control in RegisterMachine D-Bus method (bsc#1259650). - CVE-2026-29111: local unprivileged user can t…

    first Apr 7, 2026
  • Medium max 4.1
    openSUSE-SU-2026:20472-1 1 CVE

    Security update for tar

    This update for tar fixes the following issue: Security issue: - CVE-2025-45582: file overwrite via directory traversal in crafted TAR archives (bsc#1246399). Non security issue: - Fixes tar creating invalid tarballs when used with --delete (bsc#1246607)

    first Apr 7, 2026
  • High max 7.5
    openSUSE-SU-2026:20470-1 1 CVE

    Security update for libtasn1

    This update for libtasn1 fixes the following issues: - CVE-2025-13151: lack of validation of input data size leads to stack-based buffer overflow in `asn1_expend_octet_string` (bsc#1256341).

    first Apr 7, 2026
  • High max 8.5
    openSUSE-SU-2026:20465-1 1 CVE

    Security update for tigervnc

    This update for tigervnc fixes the following issues: - CVE-2026-34352: Fixed permissions to prevent other users from observing the screen, or modifying what is sent to the client. (bsc#1260871)

    first Apr 7, 2026
  • Medium max 5.9
    SUSE-SU-2026:20986-1 2 CVEs

    Security update for postgresql13

    This update for postgresql13 fixes the following issues: Security fixes: - CVE-2025-12817: Fixed missing check for CREATE privileges on the schema in CREATE STATISTICS allowed table owners to create statistics in any schema, potentially leading to unexpected …

    first Mar 30, 2026
  • High max 8.7
    openSUSE-SU-2026:20469-1 1 CVE

    Security update for cockpit-packages

    This update for cockpit-packages fixes the following issue: Update cockpit-packages to version 4: - CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character that doesn't appear in the test string (…

    first Apr 7, 2026
  • Medium max 5.3
    SUSE-SU-2026:20984-1 2 CVEs

    Security update for gnutls

    This update for gnutls fixes the following issues: - CVE-2025-14831: Fixed DoS via excessive resource consumption during certificate verification. (bsc#1257960) - CVE-2025-9820: Fixed a buffer overflow in gnutls_pkcs11_token_init. (bsc#1254132) - Add the func…

    first Mar 30, 2026
  • Critical max 9.8
    openSUSE-SU-2026:10517-1 5 CVEs

    python313-Django6-6.0.4-1.1 on GA media

    These are all security issues fixed in the python313-Django6-6.0.4-1.1 package on the GA media of openSUSE Tumbleweed.

    first Apr 9, 2026
  • Critical max 9.8
    openSUSE-SU-2026:10514-1 9 CVEs

    go1.25-1.25.9-1.1 on GA media

    These are all security issues fixed in the go1.25-1.25.9-1.1 package on the GA media of openSUSE Tumbleweed.

    first Apr 9, 2026
  • High max 8.2
    openSUSE-SU-2026:10515-1 1 CVE

    libprotobuf-lite34_1_0-32bit-34.1-1.1 on GA media

    These are all security issues fixed in the libprotobuf-lite34_1_0-32bit-34.1-1.1 package on the GA media of openSUSE Tumbleweed.

    first Apr 9, 2026
  • High max 7.8
    SUSE-SU-2026:1237-1 4 CVEs

    Security update for the Linux Kernel (Live Patch 47 for SUSE Linux Enterprise 15 SP4)

    This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.187 fixes various security issues The following security issues were fixed: - CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256780…

    first Apr 9, 2026
  • High max 8.8
    openSUSE-SU-2026:10513-1 1 CVE

    fontforge-20251009-6.1 on GA media

    These are all security issues fixed in the fontforge-20251009-6.1 package on the GA media of openSUSE Tumbleweed.

    first Apr 9, 2026
  • Critical max 9.8
    openSUSE-SU-2026:10511-1 5 CVEs

    MozillaFirefox-149.0.2-1.1 on GA media

    These are all security issues fixed in the MozillaFirefox-149.0.2-1.1 package on the GA media of openSUSE Tumbleweed.

    first Apr 9, 2026
  • High max 8.8
    SUSE-SU-2026:1236-1 8 CVEs

    Security update for the Linux Kernel (Live Patch 12 for SUSE Linux Enterprise 15 SP6)

    This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.53 fixes various security issues The following security issues were fixed: - CVE-2025-39973: i40e: add validation for ring_len param (bsc#1252036). - CVE-2025-40018: ipvs: Defer ip_vs_ftp unregi…

    first Apr 9, 2026
  • None max 0.0
    openSUSE-SU-2026:10521-1 1 CVE

    python312-3.12.13-5.1 on GA media

    These are all security issues fixed in the python312-3.12.13-5.1 package on the GA media of openSUSE Tumbleweed.

    first Apr 9, 2026
  • High max 7.5
    openSUSE-SU-2026:10512-1 1 CVE

    aws-c-event-stream-devel-0.7.0-1.1 on GA media

    These are all security issues fixed in the aws-c-event-stream-devel-0.7.0-1.1 package on the GA media of openSUSE Tumbleweed.

    first Apr 9, 2026
  • Medium max 5.7
    openSUSE-SU-2026:10522-1 2 CVEs

    python315-3.15.0~a8-1.1 on GA media

    These are all security issues fixed in the python315-3.15.0~a8-1.1 package on the GA media of openSUSE Tumbleweed.

    first Apr 9, 2026