SUSE openSUSE Tumbleweed vulnerabilities

12 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Latest SUSE openSUSE Tumbleweed vulnerabilities

CVE-2026-59679 — fs_read_glyphs() heap OOB read/write via encoding array index mismatch in libXfont2 (CVSS 9.0)
CVE-2026-44950 — fs_read_glyphs() heap buffer overflow via cumulative glyph data overflow in libXfont2 (CVSS 9.0)
CVE-2026-59674 — LPE from suricata user to root due to chown in %post in suricata packaging (CVSS 7.1)
CVE-2026-41051 — csync2 uses insecure temporary directories when compiled with C99 or later (CVSS 5.0)
CVE-2025-53882 — The logrotate configuration in the python-mailman of openSUSE allows the mailman user to sent SIGHUP to arbitrary proceess (CVSS 4.4)
CVE-2025-23394 — daily-backup.sh script in cyrus-imapd allows escalation from cyrus to root (CVSS 9.8)
CVE-2025-23386 — gerbera: Privilege escalation from user gerbera to root because of insecure %post script (CVSS 7.8)
CVE-2024-49504 — grub2 allows bypassing TPM-bound disk encryption on SL(E)M encrypted Images (CVSS 7.0)
CVE-2024-22034 — Crafted projects can overwrite special files in the .osc config directory (CVSS 5.5)
CVE-2024-22033 — obs-service-download_url is vulnerable to argument injection (CVSS 6.3)
CVE-2024-22029 — tomcat packaging allows for escalation to root from tomcat user (CVSS 7.8)
CVE-2023-32190 — mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable (CVSS 7.8)