govulncheck-vulndb vulnerabilities (openSUSE)
2,654 vulnerabilities.
govulncheck-vulndbopenSUSECasdoor Webhook URL server-side request forgery5.1 Mediumgovulncheck-vulndbopenSUSECasdoor dangerouslySetInnerHTML cross site scripting5.1 Mediumgovulncheck-vulndbopenSUSEFocalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix)4.3 Mediumgovulncheck-vulndbopenSUSEFocalboard Second-Order SQL Injection in category reorder endpoint allows data exfiltration (unsupported product, no fix)8.1 Highgovulncheck-vulndbopenSUSECasdoor OAuth Authorization Request redirect5.3 Mediumgovulncheck-vulndbopenSUSEImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload9.8 Criticalgovulncheck-vulndbopenSUSEgoshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload9.8 Criticalgovulncheck-vulndbopenSUSEMissing Encryption of Sensitive Data in antrea.io/antrea7.1 Highgovulncheck-vulndbopenSUSEEch0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata7.2 Highgovulncheck-vulndbopenSUSEEch0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature7.5 Highgovulncheck-vulndbopenSUSEGo JOSE affect by a panic in JWE decryption7.5 Highgovulncheck-vulndbopenSUSEDgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization10.0 Criticalgovulncheck-vulndbopenSUSElistmonk: Active sessions remain valid after password reset and password change7.1 Highgovulncheck-vulndbopenSUSEFerret has a Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websites8.1 Highgovulncheck-vulndbopenSUSENhost Leaks the Refresh Token via URL Query Parameter in OAuth Provider Callback2.3 Lowgovulncheck-vulndbopenSUSEKubeAI has an OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods8.7 Highgovulncheck-vulndbopenSUSEElla Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber2.7 Lowgovulncheck-vulndbopenSUSEElla Core Panics Upon NGAP handover failure5.8 Mediumgovulncheck-vulndbopenSUSEModel Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on Localhost7.6 Highgovulncheck-vulndbopenSUSEgoshs has Auth Bypass via Share Token8.1 Highgovulncheck-vulndbopenSUSETinyauth has OAuth account confusion via shared mutable state on singleton service instances7.7 Highgovulncheck-vulndbopenSUSECross Namespace Access via Batch Operation2.3 Lowgovulncheck-vulndbopenSUSEImproper TLS Client/Server authentication and certificate verification on Database Cluster10.0 Criticalgovulncheck-vulndbopenSUSEFile Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injection6.9 Mediumgovulncheck-vulndbopenSUSEFile Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution8.1 Highgovulncheck-vulndbopenSUSEFile Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file7.6 Highgovulncheck-vulndbopenSUSECloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)8.1 Highgovulncheck-vulndbopenSUSESiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )8.6 Highgovulncheck-vulndbopenSUSESiYuan: Stored XSS in imported .sy.zip content leads to arbitrary command execution8.6 Highgovulncheck-vulndbopenSUSESiYuan: Cross-Origin RCE via Permissive CORS Policy and JavaScript Snippet Injection9.7 Criticalgovulncheck-vulndbopenSUSESiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop client9.1 Criticalgovulncheck-vulndbopenSUSESiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked content7.5 Highgovulncheck-vulndbopenSUSESliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface5.9 Mediumgovulncheck-vulndbopenSUSECVE-2026-47899.8 Criticalgovulncheck-vulndbopenSUSEgo-git: Maliciously crafted idx file can cause asymmetric memory consumption5.0 Mediumgovulncheck-vulndbopenSUSEDocker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF)6.8 Mediumgovulncheck-vulndbopenSUSEgo-git: Missing validation decoding Index v4 files leads to panic2.8 Lowgovulncheck-vulndbopenSUSENginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover9.8 Criticalgovulncheck-vulndbopenSUSENginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys8.8 Highgovulncheck-vulndbopenSUSENginx UI: DoS via Negative Integer Input in Logrotate Interval6.9 Mediumgovulncheck-vulndbopenSUSENginx UI: Race Condition Leads to Persistent Data Corruption and Service Collapse7.1 Highgovulncheck-vulndbopenSUSENginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration Directory6.9 Mediumgovulncheck-vulndbopenSUSEnginx-ui Backup Restore Allows Tampering with Encrypted Backups9.4 Criticalgovulncheck-vulndbopenSUSEGotenberg: Chromium deny-list bypass via case-insensitive URL scheme7.8 Highgovulncheck-vulndbopenSUSEMinIO is Vulnerable to SSE Metadata Injection via Replication Headers7.1 Highgovulncheck-vulndbopenSUSEact: actions/cache server allows malicious cache injection8.2 Highgovulncheck-vulndbopenSUSEFlannel vulnerable to cross-node remote code execution via extension backend BackendData injection7.5 Highgovulncheck-vulndbopenSUSEFleet's user account creation via invite does not enforce invited email address4.9 Mediumgovulncheck-vulndbopenSUSEact: Unrestricted set-env and add-path command processing enables environment injection7.7 Highgovulncheck-vulndbopenSUSEFleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint6.6 Medium- Show moreLoading…