govulncheck-vulndb vulnerabilities (openSUSE)
2,654 vulnerabilities.
govulncheck-vulndbopenSUSEFission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration7.7 Highgovulncheck-vulndbopenSUSEAnyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion7.3 Highgovulncheck-vulndbopenSUSEOpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoning5.0 Mediumgovulncheck-vulndbopenSUSEApache Answer: AdminToken not invalidated after admin deactivation7.2 Highgovulncheck-vulndbopenSUSEApptainer: Incorrect path matching for 'limit container paths' directive4.8 Mediumgovulncheck-vulndbopenSUSEMigration-planner: getsourcedownloadurl missing organization check9.6 Criticalgovulncheck-vulndbopenSUSEAssisted-migration-agent: vddk tarball chained-symlink arbitrary file write9.6 Criticalgovulncheck-vulndbopenSUSEAssisted-migration-agent: tls verification disabled on all vcenter connections9.3 Criticalgovulncheck-vulndbopenSUSEMigration-planner: agent api ignores jwt source_id claim9.6 Criticalgovulncheck-vulndbopenSUSEMigration-planner: second-order sql injection via rvtools upload9.6 Criticalgovulncheck-vulndbopenSUSEMigration-planner: unprotected delete endpoint wipes all tenant data9.1 Criticalgovulncheck-vulndbopenSUSENezha Monitoring: Private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data5.3 Mediumgovulncheck-vulndbopenSUSENezha Monitoring: Cross-site GET request can trigger stored cron commands on a victim's agents7.1 Highgovulncheck-vulndbopenSUSEGo Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery9.1 Criticalgovulncheck-vulndbopenSUSEApache Answer: Unlisted Questions Accessible via Direct API Access6.5 Mediumgovulncheck-vulndbopenSUSEApache Answer: HTML Content Injection in Email5.4 Mediumgovulncheck-vulndbopenSUSEApache Answer: The custom avatar was not properly validated6.5 Mediumgovulncheck-vulndbopenSUSEApache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error6.5 Mediumgovulncheck-vulndbopenSUSEApache Answer: Authorization Bypass in Timeline API6.1 Mediumgovulncheck-vulndbopenSUSEApache Answer: XSS in AI Answer Rendering6.1 Mediumgovulncheck-vulndbopenSUSEArc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks7.1 Highgovulncheck-vulndbopenSUSEnebula-mesh: GET /api/v1/audit-log discloses all entries to any operator7.1 Highgovulncheck-vulndbopenSUSEnebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints6.9 Mediumgovulncheck-vulndbopenSUSEnebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation9.9 Criticalgovulncheck-vulndbopenSUSEnebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)7.1 Highgovulncheck-vulndbopenSUSEnebula-mesh: Host advanced overrides allow YAML injection into agent config.yml8.7 Highgovulncheck-vulndbopenSUSEAnyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS plugins (Brave, Chrome, Edge, Reminders, Safari)9.0 Criticalgovulncheck-vulndbopenSUSEWeaviate Static API Key client.go validateConfig authorization2.3 Lowgovulncheck-vulndbopenSUSEyoanbernabeu grepai Postgres Embedding Cache chunker.go PostgresStore.LookupByContentHash weak hash2.0 Lowgovulncheck-vulndbopenSUSEyoanbernabeu grepai Qdrant Backend chunker.go weak hash2.3 Lowgovulncheck-vulndbopenSUSERclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix9.8 Criticalgovulncheck-vulndbopenSUSEsongquanpeng one-api Redemption Code Top-Up Endpoint redemption.go Redeem logic error2.3 Lowgovulncheck-vulndbopenSUSEPrivilege Escalation in AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL8.6 Highgovulncheck-vulndbopenSUSEKlever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chain7.5 Highgovulncheck-vulndbopenSUSEKlever-Go: REST API slow-header connection exhaustion via Gin Engine.Run7.5 Highgovulncheck-vulndbopenSUSEKlever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS7.5 Highgovulncheck-vulndbopenSUSEKlever-Go KVM: Throttler slot leak in trie account-data sync causes epoch bootstrap / state sync DoS5.9 Mediumgovulncheck-vulndbopenSUSESource controller: Improper path handling allows traversal5.3 Mediumgovulncheck-vulndbopenSUSEKlever-Go KVM: Hash-array amplification in P2P resolver request handling7.5 Highgovulncheck-vulndbopenSUSEOmni: Reader-level users can retrieve imported cluster CA keys via ResourceService7.6 Highgovulncheck-vulndbopenSUSEOmni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic2.7 Lowgovulncheck-vulndbopenSUSEOmni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session token7.0 Highgovulncheck-vulndbopenSUSEAdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle6.3 Mediumgovulncheck-vulndbopenSUSEOpenMeter SQL Injection in ClickHouse-backed Meter Definitions8.9 Highgovulncheck-vulndbopenSUSENhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets5.4 Mediumgovulncheck-vulndbopenSUSESingularity: Incorrect path matching for 'limit container paths' directive4.8 Mediumgovulncheck-vulndbopenSUSENuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project8.3 Highgovulncheck-vulndbopenSUSEmilvus-io milvus Grantee ID Hash kv_catalog.go weak hash2.0 Lowgovulncheck-vulndbopenSUSEquic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion5.3 Mediumgovulncheck-vulndbopenSUSEcilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec integer overflow4.8 Medium- Show moreLoading…