govulncheck-vulndb vulnerabilities (openSUSE)
2,654 vulnerabilities.
govulncheck-vulndbopenSUSESecurity update for govulncheck-vulndbNo scoregovulncheck-vulndbopenSUSEZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions5.5 Mediumgovulncheck-vulndbopenSUSErclone: source object names can escape the configured root on upload5.3 Mediumgovulncheck-vulndbopenSUSErclone: S3 multipart declared-length memory exhaustion7.5 Highgovulncheck-vulndbopenSUSErclone: RC per-server auth-proxy bypass9.1 Criticalgovulncheck-vulndbopenSUSErclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass9.8 Criticalgovulncheck-vulndbopenSUSErclone: FTP cross-session auth-proxy backend confusion7.3 Highgovulncheck-vulndbopenSUSErclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination7.1 Highgovulncheck-vulndbopenSUSErclone local: crafted Range request against a translated symlink panics (DoS)5.3 Mediumgovulncheck-vulndbopenSUSErclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace6.3 Mediumgovulncheck-vulndbopenSUSErclone: http backend forwards custom/auth headers to a different host on redirect3.7 Lowgovulncheck-vulndbopenSUSETraefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging8.8 Highgovulncheck-vulndbopenSUSETraefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization7.0 Highgovulncheck-vulndbopenSUSETraefik HTTP/3 Backend NTLM Connection Reuse9.1 Criticalgovulncheck-vulndbopenSUSETraefik entrypoint header-name sanitization bypassed via request trailers7.0 Highgovulncheck-vulndbopenSUSETraefik: ForwardAuth identity spoofing via dot-form header alias5.3 Mediumgovulncheck-vulndbopenSUSETraefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded5.3 Mediumgovulncheck-vulndbopenSUSEidentrail: Cross-tenant GitHub installation binding without ownership verification8.5 Highgovulncheck-vulndbopenSUSEJoker linter executed project-local .jokerd/linter.* files during linting7.8 Highgovulncheck-vulndbopenSUSEwebhookd: Unrestricted HTTP Header to Shell Variable Injection6.5 Mediumgovulncheck-vulndbopenSUSELF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint5.5 Mediumgovulncheck-vulndbopenSUSELF Edge eKuiper: SSRF in External Service5.5 Mediumgovulncheck-vulndbopenSUSELF Edge eKuiper: Self-XSS in External Service Creation3.7 Lowgovulncheck-vulndbopenSUSEcontainerd CRI ExecSync Goroutine Leak Leading to Node-Level Denial of Service6.8 Mediumgovulncheck-vulndbopenSUSEgRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers8.7 Highgovulncheck-vulndbopenSUSEOpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool6.5 Mediumgovulncheck-vulndbopenSUSEPrevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh7.5 Highgovulncheck-vulndbopenSUSEPrevent DoS on deadlocked established channel in golang.org/x/crypto/ssh7.5 Highgovulncheck-vulndbopenSUSEgRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation8.7 Highgovulncheck-vulndbopenSUSEgRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion6.3 Mediumgovulncheck-vulndbopenSUSEfree5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA3.7 Lowgovulncheck-vulndbopenSUSEfree5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI7.5 Highgovulncheck-vulndbopenSUSEKlever-Go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply8.7 Highgovulncheck-vulndbopenSUSEArc: Unauthenticated cluster node admission when `cluster.shared_secret` is unset6.9 Mediumgovulncheck-vulndbopenSUSEKlever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits8.7 Highgovulncheck-vulndbopenSUSEALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server7.5 Highgovulncheck-vulndbopenSUSEBifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL8.7 Highgovulncheck-vulndbopenSUSEfree5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints9.3 Criticalgovulncheck-vulndbopenSUSEVikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment5.0 Mediumgovulncheck-vulndbopenSUSEVikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id7.1 Highgovulncheck-vulndbopenSUSEVikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api8.1 Highgovulncheck-vulndbopenSUSEVikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=04.3 Mediumgovulncheck-vulndbopenSUSEVikunja: Project duplication bypasses write-permission check on the target parent project5.3 Mediumgovulncheck-vulndbopenSUSEPocket ID: Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none4.3 Mediumgovulncheck-vulndbopenSUSEaqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory6.6 Mediumgovulncheck-vulndbopenSUSEKlever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)9.6 Criticalgovulncheck-vulndbopenSUSEKlever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)9.6 Criticalgovulncheck-vulndbopenSUSEKubeVela Terraform remote loader DoS via unbounded file read8.5 Highgovulncheck-vulndbopenSUSEHatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe6.4 Mediumgovulncheck-vulndbopenSUSESource-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh7.5 High- Show olderLoading…