What’s Vulnerable › Products

SUSE libzypp vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your SUSE libzypp version is affected

Latest SUSE libzypp vulnerabilities

• CVE-2026-44941 — libzypp path traversal via "keyhint" in repomd.xml (CVSS 8.8)
• CVE-2026-25707 — Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp (CVSS 8.8)
• CVE-2026-44942 — libzypp .repo files can have an optional path which can lead to path traversal attacks (CVSS 6.5)
• CVE-2019-18900 — libzypp stores cookies world readable (CVSS 3.3)
• CVE-2018-7685 — libzypp does not reevaluate malicious rpms once downloaded (CVSS 7.8)
• CVE-2017-9269 — lack of keypinning in libzypp could lead to repository switching (CVSS 9.8)
• CVE-2017-7436 — libzypp accepts unsigned packages even when configured to check signatures (CVSS 8.1)
• CVE-2017-7435 — libzypp accepts unsigned 3rd party repo without warning (CVSS 8.1)