govulncheck-vulndb vulnerabilities (openSUSE)
2,654 vulnerabilities.
govulncheck-vulndbopenSUSEExternal Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore5.3 Mediumgovulncheck-vulndbopenSUSEnuts-node: JWT type confusion in v1 access token introspection allows VP replay as access token4.4 Mediumgovulncheck-vulndbopenSUSEBoundary Workers Vulnerable to Denial of Service During TLS Handshake7.5 Highgovulncheck-vulndbopenSUSEapko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)7.5 Highgovulncheck-vulndbopenSUSEapko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root7.5 Highgovulncheck-vulndbopenSUSEapko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery6.5 Mediumgovulncheck-vulndbopenSUSEPrivilege Escalation Attack affecting Pelican Web UI9.0 Criticalgovulncheck-vulndbopenSUSEDistribution: Tag deletion bypasses `storage.delete.enabled` configuration6.3 Mediumgovulncheck-vulndbopenSUSEUnauthenticated Remote Code Execution via Backup Restore in nginx-ui9.0 Criticalgovulncheck-vulndbopenSUSEArgo Workflows: Exposure of artifact repository credentials8.5 Highgovulncheck-vulndbopenSUSEnginx-ui: Settings API Exposes Protected Secrets6.5 Mediumgovulncheck-vulndbopenSUSEArgo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure8.1 Highgovulncheck-vulndbopenSUSEnginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover8.1 Highgovulncheck-vulndbopenSUSEArgo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor8.2 Highgovulncheck-vulndbopenSUSEnginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim8.1 Highgovulncheck-vulndbopenSUSEnginx-ui: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback6.5 Mediumgovulncheck-vulndbopenSUSEArgo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)2.3 Lowgovulncheck-vulndbopenSUSEArgo Workflows Is Missing Authorization in Sync ConfigMap Provider8.5 Highgovulncheck-vulndbopenSUSEIncus: Unbounded binary import disk exhaustion4.3 Mediumgovulncheck-vulndbopenSUSEIncus: Nil Dereferences on Restore via Malformed YAML6.5 Mediumgovulncheck-vulndbopenSUSEIncus: Unbounded YAML Metadata Decode via Parsing5.3 Mediumgovulncheck-vulndbopenSUSEIncus: Nil-Pointer Dereference via S3 Bucket Import6.5 Mediumgovulncheck-vulndbopenSUSETraefik: Errors middleware forwards Authorization and Cookie headers to separate error page service6.9 Mediumgovulncheck-vulndbopenSUSEGotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Move8.2 Highgovulncheck-vulndbopenSUSEIncus out-of-bounds panic in snapshot metadata handling allows denial of service7.1 Highgovulncheck-vulndbopenSUSEIncus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation2.3 Lowgovulncheck-vulndbopenSUSEIncus nil-pointer dereference in custom volume import allows denial of service7.1 Highgovulncheck-vulndbopenSUSEIncus nil-pointer dereference in storage bucket import allows denial of service7.1 Highgovulncheck-vulndbopenSUSEIncus blind SSRF via image import preflight HEAD request5.3 Mediumgovulncheck-vulndbopenSUSEOllama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers8.8 Highgovulncheck-vulndbopenSUSEosrg GoBGP BMP Parser bmp.go BMPStatisticsReport.ParseBody out-of-bounds6.9 Mediumgovulncheck-vulndbopenSUSEosrg GoBGP mrt.go parseRibEntry integer underflow6.9 Mediumgovulncheck-vulndbopenSUSEosrg GoBGP SRv6 L3 Service prefix_sid.go SRv6L3ServiceAttribute.DecodeFromBytes denial of service6.9 Mediumgovulncheck-vulndbopenSUSEPrometheus: remote read endpoint allows denial of service via crafted snappy payload7.5 Highgovulncheck-vulndbopenSUSEPrometheus Azure AD remote write OAuth client secret exposed via config API7.5 Highgovulncheck-vulndbopenSUSEGoBGP has an out-of-bounds read in the ParseIP6Extended function7.5 Highgovulncheck-vulndbopenSUSEArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction9.6 Criticalgovulncheck-vulndbopenSUSEArcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)8.7 Highgovulncheck-vulndbopenSUSEauth: Patreon provider assigns the same local user ID to every authenticated Patreon account, enabling cross‑user impersonation9.1 Criticalgovulncheck-vulndbopenSUSEGotenberg vulnerable to argument injection via newlines in ExifTool metadata values10.0 Criticalgovulncheck-vulndbopenSUSEGotenberg unauthenticated blind SSRF via unfiltered webhook URL6.9 Mediumgovulncheck-vulndbopenSUSEGotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists7.8 Highgovulncheck-vulndbopenSUSENginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services8.5 Highgovulncheck-vulndbopenSUSEGoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE7.5 Highgovulncheck-vulndbopenSUSEGoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute7.5 Highgovulncheck-vulndbopenSUSECoreDNS TSIG authentication bypass on gRPC, QUIC, DoH, and DoH3 transports8.2 Highgovulncheck-vulndbopenSUSECoreDNS TSIG authentication bypass on encrypted DNS transports8.7 Highgovulncheck-vulndbopenSUSECoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison8.2 Highgovulncheck-vulndbopenSUSECoreDNS DoH GET path missing size validation causes CPU and memory amplification8.7 Highgovulncheck-vulndbopenSUSECoreDNS DNS-over-QUIC unbounded goroutine growth leads to denial of service8.7 High- Show moreLoading…