govulncheck-vulndb vulnerabilities (openSUSE)
2,654 vulnerabilities.
govulncheck-vulndbopenSUSENATS has MQTT plaintext password disclosure8.6 Highgovulncheck-vulndbopenSUSENATS Server panic via malicious compression on leafnode port7.5 Highgovulncheck-vulndbopenSUSENATS is vulnerable to MQTT hijacking via Client ID6.5 Mediumgovulncheck-vulndbopenSUSENATS credentials are exposed in monitoring port via command-line argv7.4 Highgovulncheck-vulndbopenSUSENATS: Message tracing can be redirected to arbitrary subject4.3 Mediumgovulncheck-vulndbopenSUSEPinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token4.8 Mediumgovulncheck-vulndbopenSUSEPinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command Execution6.7 Mediumgovulncheck-vulndbopenSUSEA PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript Execution6.1 Mediumgovulncheck-vulndbopenSUSEPinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems4.3 Mediumgovulncheck-vulndbopenSUSEPinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl4.1 Mediumgovulncheck-vulndbopenSUSEGoDoxy has a Path Traversal Vulnerability in its File API6.5 Mediumgovulncheck-vulndbopenSUSEAuthelia: Improper Neutralization of Input During Web Page Generation Leads to Potential Cross-site Scripting0.5 Lowgovulncheck-vulndbopenSUSEVikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion6.9 Mediumgovulncheck-vulndbopenSUSEVikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation7.5 Highgovulncheck-vulndbopenSUSEVikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections6.4 Mediumgovulncheck-vulndbopenSUSEVikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion8.1 Highgovulncheck-vulndbopenSUSEWebhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API6.5 Mediumgovulncheck-vulndbopenSUSEVikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read6.5 Mediumgovulncheck-vulndbopenSUSEVikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources6.4 Mediumgovulncheck-vulndbopenSUSEVikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect7.1 Highgovulncheck-vulndbopenSUSETrivy ecosystem supply chain briefly compromised9.4 Criticalgovulncheck-vulndbopenSUSENew API has passkey-based secure step-up verification bypass for root-only channel secret disclosure4.9 Mediumgovulncheck-vulndbopenSUSENew API: IDOR in VideoProxy allows cross-user video content access via missing ownership check6.5 Mediumgovulncheck-vulndbopenSUSEUse of hard coded credentials in GoHarbor Harbor9.4 Criticalgovulncheck-vulndbopenSUSEDigitalOcean Droplet Agent: Command Injection via Metadata Service Endpoint8.8 Highgovulncheck-vulndbopenSUSEFree5GC AMF handler.go HandleRegistrationComplete denial of service6.9 Mediumgovulncheck-vulndbopenSUSECSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS server6.5 Mediumgovulncheck-vulndbopenSUSEOry Keto has a SQL injection via forged pagination tokens7.2 Highgovulncheck-vulndbopenSUSEOry Hydra has a SQL injection via forged pagination tokens7.2 Highgovulncheck-vulndbopenSUSEOry Kratos has a SQL injection via forged pagination tokens7.2 Highgovulncheck-vulndbopenSUSEOry Oathkeeper has a path traversal authorization bypass10.0 Criticalgovulncheck-vulndbopenSUSEOry Oathkeeper has an authentication bypass by cache key confusion8.1 Highgovulncheck-vulndbopenSUSEOry Oathkeeper has an authentication bypass by usage of untrusted header6.5 Mediumgovulncheck-vulndbopenSUSEetcd: Authorization bypasses in multiple APIs8.8 Highgovulncheck-vulndbopenSUSEMinIO: LDAP login brute-force via user enumeration and missing rate limit9.1 Criticalgovulncheck-vulndbopenSUSESyft improper temporary file cleanup5.3 Mediumgovulncheck-vulndbopenSUSESiYuan has an Unauthenticated Arbitrary File Read via Path Traversal7.5 Highgovulncheck-vulndbopenSUSEVikunja Affected by DoS via Image Preview Generation6.5 Mediumgovulncheck-vulndbopenSUSEVikunja has TOTP Reuse During Validity Window5.7 Mediumgovulncheck-vulndbopenSUSEetcd: Nested etcd transactions bypass RBAC authorization checks0.0 Nonegovulncheck-vulndbopenSUSEVikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement8.1 Highgovulncheck-vulndbopenSUSEVikunja has a 2FA Bypass via Caldav Basic Auth6.9 Mediumgovulncheck-vulndbopenSUSEVikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments5.3 Mediumgovulncheck-vulndbopenSUSERead-only Vikunja users can delete project background images via broken object-level authorization5.3 Mediumgovulncheck-vulndbopenSUSEVikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers5.3 Mediumgovulncheck-vulndbopenSUSETraefik: BasicAuth Middleware Timing Attack Allows Username Enumeration6.3 Mediumgovulncheck-vulndbopenSUSETraefik mTLS bypass via fragmented ClientHello SNI extraction failure7.8 Highgovulncheck-vulndbopenSUSEingress-nginx comment-based nginx configuration injection8.8 Highgovulncheck-vulndbopenSUSESoft Serve: Authenticated repo import can clone server-local private repositories7.1 Highgovulncheck-vulndbopenSUSEDagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG8.1 High- Show moreLoading…