govulncheck-vulndb vulnerabilities (openSUSE)
2,654 vulnerabilities.
govulncheck-vulndbopenSUSEMailpit Vulnerable to Server-Side Request Forgery (SSRF) via HTML Check API5.8 Mediumgovulncheck-vulndbopenSUSEMailpit has SMTP Header Injection via Regex Bypass5.3 Mediumgovulncheck-vulndbopenSUSEesm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packages7.7 Highgovulncheck-vulndbopenSUSESkipper arbitrary code execution through lua filters8.8 Highgovulncheck-vulndbopenSUSESiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File Upload5.3 Mediumgovulncheck-vulndbopenSUSEUnexpected session resumption in crypto/tls10.0 Criticalgovulncheck-vulndbopenSUSEArbitrary file write using cgo pkg-config directive in cmd/go7.8 Highgovulncheck-vulndbopenSUSEUnexpected code execution when invoking toolchain in cmd/go7.0 Highgovulncheck-vulndbopenSUSEHandshake messages may be processed at the incorrect encryption level in crypto/tls5.3 Mediumgovulncheck-vulndbopenSUSEExcessive CPU consumption when building archive index in archive/zip6.5 Mediumgovulncheck-vulndbopenSUSEMemory exhaustion in query parameter parsing in net/url7.5 Highgovulncheck-vulndbopenSUSEApplication-Level DoS via infinite re-render loop in user profile handling6.8 Mediumgovulncheck-vulndbopenSUSEDoS from quadratic complexity in model.ParseHashtags3.1 Lowgovulncheck-vulndbopenSUSETraefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall5.9 Mediumgovulncheck-vulndbopenSUSElakeFS is Missing Timestamp Validation in S3 Gateway Authentication6.5 Mediumgovulncheck-vulndbopenSUSEArcane has a Command Injection in Arcane Updater Lifecycle Labels Enables RCE9.1 Criticalgovulncheck-vulndbopenSUSEZITADEL has a user enumeration vulnerability in Login UIs5.3 Mediumgovulncheck-vulndbopenSUSEDPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface8.1 Highgovulncheck-vulndbopenSUSEImproper Input Validation in Metricbeat Leading to Denial of Service6.5 Mediumgovulncheck-vulndbopenSUSEgo-ethereum has a DoS via malicious p2p message7.1 Highgovulncheck-vulndbopenSUSEgo-ethereum has a DoS via malicious p2p message7.1 Highgovulncheck-vulndbopenSUSEGin-vue-admin has arbitrary file upload vulnerability caused by path traversal7.3 Highgovulncheck-vulndbopenSUSEFulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass5.8 Mediumgovulncheck-vulndbopenSUSEEnvoy Extension Policy lua scripts injection causes arbitrary command execution8.8 Highgovulncheck-vulndbopenSUSECosign verification accepts any valid Rekor entry under certain conditions5.5 Mediumgovulncheck-vulndbopenSUSEMailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails6.5 Mediumgovulncheck-vulndbopenSUSEWeKnora has Command Injection in MCP stdio test10.0 Criticalgovulncheck-vulndbopenSUSEWeKnora vulnerable to SQL Injection5.6 Mediumgovulncheck-vulndbopenSUSEShiori is vulnerable to authentication bypass via a brute force attack6.5 Mediumgovulncheck-vulndbopenSUSESoft Serve is missing an authorization check in LFS lock deletion5.4 Mediumgovulncheck-vulndbopenSUSECoreDNS gRPC/HTTPS/HTTP3 servers lack resource limits, enabling DoS via unbounded connections and oversized messages6.6 Mediumgovulncheck-vulndbopenSUSEMiniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources6.5 Mediumgovulncheck-vulndbopenSUSEOpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization9.3 Criticalgovulncheck-vulndbopenSUSEMailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF)5.8 Mediumgovulncheck-vulndbopenSUSEPterodactyl does not revoke SFTP access when server is deleted or permissions reduced7.5 Highgovulncheck-vulndbopenSUSEHarvest may expose OS default ssh login password via SUSE Virtualization Interactive Installer9.8 Criticalgovulncheck-vulndbopenSUSElistmonk Vulnerable to Stored XSS Leading to Admin Account Takeover5.4 Mediumgovulncheck-vulndbopenSUSEGitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists5.3 Mediumgovulncheck-vulndbopenSUSEExecuteMultiOperation Namespace Policy Bypass1.3 Lowgovulncheck-vulndbopenSUSECross Namespace Commands Authorization Bypass5.3 Mediumgovulncheck-vulndbopenSUSEUnexpected untrusted code execution in github.com/golang/vscode-go5.4 Mediumgovulncheck-vulndbopenSUSEactiontech sqle JWT Secret jwt.go hard-coded key6.3 Mediumgovulncheck-vulndbopenSUSEGitea vulnerable to Cross-site Scripting5.4 Mediumgovulncheck-vulndbopenSUSEGitea: anonymous user can visit private user's project5.8 Mediumgovulncheck-vulndbopenSUSEGitea sometimes mishandles propagation of token scope for access control within one of its own package registries5.0 Mediumgovulncheck-vulndbopenSUSEGitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order5.3 Mediumgovulncheck-vulndbopenSUSEGitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text5.4 Mediumgovulncheck-vulndbopenSUSEGitea mishandles access to a private resource upon receiving an API token with scope limited to public resources4.9 Mediumgovulncheck-vulndbopenSUSEGitea doesn't adequately enforce branch deletion permissions after merging a pull request.3.1 Lowgovulncheck-vulndbopenSUSEGitea allows attackers to add attachments with forbidden file extensions8.2 High- Show moreLoading…