govulncheck-vulndb vulnerabilities (openSUSE)
2,654 vulnerabilities.
govulncheck-vulndbopenSUSESiYuan: Incomplete sanitization of bazaar README allows stored XSS via iframe srcdoc (incomplete fix for CVE-2026-33066)5.3 Mediumgovulncheck-vulndbopenSUSEgithub.com/gomarkdown/markdown: Out-of-bounds Read in SmartypantsRenderer7.5 Highgovulncheck-vulndbopenSUSESpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs6.0 Mediumgovulncheck-vulndbopenSUSEZarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write7.1 Highgovulncheck-vulndbopenSUSEPowerShell Command Injection in Podman HyperV Machine4.0 Mediumgovulncheck-vulndbopenSUSEgoshs: Public collaborator feed leaks .goshs ACL credentials and enables unauthorized access7.7 Highgovulncheck-vulndbopenSUSEgoshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation6.1 Mediumgovulncheck-vulndbopenSUSEgoshs: Empty-username SFTP password authentication bypass in goshs9.8 Criticalgovulncheck-vulndbopenSUSESFTP root escape via prefix-based path validation in goshs8.7 Highgovulncheck-vulndbopenSUSEOAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode9.1 Criticalgovulncheck-vulndbopenSUSEOAuth2 Proxy: Session cookie not cleared when rendering sign-in page3.5 Lowgovulncheck-vulndbopenSUSEkyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token8.1 Highgovulncheck-vulndbopenSUSEfree5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors6.9 Mediumgovulncheck-vulndbopenSUSEfree5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions8.7 Highgovulncheck-vulndbopenSUSEfree5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions8.7 Highgovulncheck-vulndbopenSUSEfree5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions8.7 Highgovulncheck-vulndbopenSUSEFree5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication7.5 Highgovulncheck-vulndbopenSUSESigstore Timestamp Authority has Improper Certificate Validation in verifier5.5 Mediumgovulncheck-vulndbopenSUSEMinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads8.8 Highgovulncheck-vulndbopenSUSEmonetr: Unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation8.2 Highgovulncheck-vulndbopenSUSENote Mark has Broken Access Control on Asset Download5.9 Mediumgovulncheck-vulndbopenSUSENote Mark: Username Enumeration via Login Endpoint Timing Side-Channel3.7 Lowgovulncheck-vulndbopenSUSENote Mark has Stored XSS via Unrestricted Asset Upload8.7 Highgovulncheck-vulndbopenSUSEMaddy Mail Server: LDAP Filter Injection via Unsanitized Username8.2 Highgovulncheck-vulndbopenSUSEPrometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer5.3 Mediumgovulncheck-vulndbopenSUSEExternal Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine7.1 Highgovulncheck-vulndbopenSUSEApache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server7.1 Highgovulncheck-vulndbopenSUSEMissing Authentication on Streaming gRPC Replication Endpoint6.3 Mediumgovulncheck-vulndbopenSUSEArcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint7.2 Highgovulncheck-vulndbopenSUSEgoshs has a file-based ACL authorization bypass in goshs state-changing routes9.3 Criticalgovulncheck-vulndbopenSUSEgoshs is Missing Write Protection for Parametric Data Values7.7 Highgovulncheck-vulndbopenSUSESiYuan: Publish Reader Path Traversal Delete via `removeUnusedAttributeView`8.5 Highgovulncheck-vulndbopenSUSESiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via removeUnusedAttributeView API8.1 Highgovulncheck-vulndbopenSUSEStep CA affected by an index out of bounds panic in TPM attestation EKU validation3.7 Lowgovulncheck-vulndbopenSUSEVikunja's Scoped API tokens with projects.background permission can delete project backgrounds4.3 Mediumgovulncheck-vulndbopenSUSEVikunja has a File Size Limit Bypass via Vikunja Import5.4 Mediumgovulncheck-vulndbopenSUSEVikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output4.1 Mediumgovulncheck-vulndbopenSUSEVikunja has HTML Injection via Task Titles in Overdue Email Notifications5.4 Mediumgovulncheck-vulndbopenSUSEVikunja has an Algorithmic Complexity DoS in Repeating Task Handler6.5 Mediumgovulncheck-vulndbopenSUSEVikunja has Missing Authorization on CalDAV Task Read4.3 Mediumgovulncheck-vulndbopenSUSEVikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout5.9 Mediumgovulncheck-vulndbopenSUSEVikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug4.3 Mediumgovulncheck-vulndbopenSUSEVikunja Affected by Privilege Escalation via Project Reparenting8.3 Highgovulncheck-vulndbopenSUSEVikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade6.5 Mediumgovulncheck-vulndbopenSUSEVikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path7.4 Highgovulncheck-vulndbopenSUSEJuju CloudSpec API could leak senstive information9.9 Criticalgovulncheck-vulndbopenSUSEJuju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map6.1 Mediumgovulncheck-vulndbopenSUSEFlux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering3.1 Lowgovulncheck-vulndbopenSUSESiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering8.7 Highgovulncheck-vulndbopenSUSEHelm Chart extraction output directory collapse via `Chart.yaml` name dot-segment4.8 Medium- Show moreLoading…