Opensuse Libzypp vulnerabilities

• opensuse libzypp libzypp path traversal via "keyhint" in repomd.xml CVE-2026-44941 Fix available 8.4 HighJune 8, 2026
• opensuse libzypp Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp CVE-2026-25707 Fix available 8.8 HighMay 29, 2026
• opensuse libzypp-plugin-appdata, leap 15.4, suse linux enterprise server for sap 15-sp3 +2 more libzypp-plugin-appdata: potential arbitrary code execution via shell injection due to `os.system` calls CVE-2023-22643 Fix available 6.3 MediumJanuary 17, 2023
• opensuse libzypp, suse caas platform 3.0, linux enterprise server 12 +1 more +3 more libzypp stores cookies world readable CVE-2019-18900 Fix available 4.0 MediumJanuary 13, 2020
• opensuse libzypp libzypp does not reevaluate malicious rpms once downloaded CVE-2018-7685 Fix available 7.8 HighAugust 30, 2018
• opensuse libzypp lack of keypinning in libzypp could lead to repository switching CVE-2017-9269 Fix available 7.7 HighAugust 3, 2017
• opensuse libzypp libzypp accepts unsigned packages even when configured to check signatures CVE-2017-7436 Fix available 8.1 HighAugust 3, 2017
• opensuse libzypp libzypp accepts unsigned 3rd party repo without warning CVE-2017-7435 Fix available 8.1 HighAugust 3, 2017