openSUSE Tumbleweed

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: openSUSE Tumbleweed 📖 ~4 min read  •  Source: SUSE security advisory Related CVEs: CVE-2025-62409 CVE-2025-62504 CVE-2025-30157 CVE-2025-62408 CVE-2024-39305 Upstream summary: Envoy is a cloud-native, open source edge and service proxy. Prior to 1.36.1, 1.35.5, 1.34.9, and 1.33.10, large requests and responses can […]

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: openSUSE Tumbleweed 📖 ~4 min read  •  Source: SUSE advisory RHSA-2026:0002 (see also SUSE bugzilla) Related CVEs: CVE-2025-45582 CVE-2022-48303 CVE-2021-20193 CVE-2001-1267 CVE-2002-0399 CVE-2005-1918 CVE-2006-0300 CVE-2006-6097  +5 more Upstream summary: GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR […]

🟡 Medium   ⏱ 10–30 min  Last verified: 25 May 2026 Affected versions: openSUSE Tumbleweed 📖 ~4 min read  •  Source: SUSE security advisory (see also SUSE bugzilla) Related CVEs: CVE-2025-5992 CVE-2024-33861 CVE-2024-30161 Upstream summary: When passing values outside of the expected range to QColorTransferGenericFunction it can cause a denial of service, for example, this […]

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: openSUSE Tumbleweed 📖 ~4 min read  •  Source: SUSE advisory SUSE-SU-2025:3744-1 (see also SUSE bugzilla) Related CVEs: CVE-2025-6545 Upstream summary: Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js. This issue […]

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: openSUSE Tumbleweed 📖 ~4 min read  •  Source: SUSE security advisory (see also SUSE bugzilla) Related CVEs: CVE-2025-56225 CVE-2025-68617 Upstream summary: fluidsynth-2.4.6 and earlier versions is vulnerable to Null pointer dereference in fluid_synth_monopoly.c, that can be triggered when loading an invalid midi […]

🟡 Medium   ⏱ 10–30 min  Last verified: 25 May 2026 Affected versions: openSUSE Tumbleweed 📖 ~4 min read  •  Source: SUSE advisory openSUSE-SU-2025:15089-1 (see also SUSE bugzilla) Related CVEs: CVE-2025-47268 Upstream summary: ping in iputils before 20250602 allows a denial of service (application error or incorrect data collection) via a crafted ICMP Echo Reply […]

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: openSUSE Tumbleweed 📖 ~4 min read  •  Source: SUSE advisory openSUSE-SU-2025:15194-1 (see also SUSE bugzilla) Related CVEs: CVE-2025-46807 CVE-2025-46806 Upstream summary: A Allocation of Resources Without Limits or Throttling vulnerability in sslh allows attackers to easily exhaust the file descriptors in sslh […]

🟡 Medium   ⏱ 10–30 min  Last verified: 25 May 2026 Affected versions: openSUSE Tumbleweed 📖 ~4 min read  •  Source: SUSE security advisory (see also SUSE bugzilla) Related CVEs: CVE-2025-68463 Upstream summary: Bio.Entrez in Biopython through 186 allows doctype XXE. Table of contents Symptom & Impact Environment & Reproduction Root Cause Analysis Quick Triage […]

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: openSUSE Tumbleweed 📖 ~4 min read  •  Source: SUSE advisory SUSE-SU-2023:1967-1 (see also SUSE bugzilla) Related CVEs: CVE-2023-26484 CVE-2025-64433 CVE-2024-33394 CVE-2025-64437 Upstream summary: KubeVirt is a virtual machine management add-on for Kubernetes. In versions 0.59.0 and prior, if a malicious user has […]

🔴 Critical   ⏱ 15–90 min  Last verified: 25 May 2026 Affected versions: openSUSE Tumbleweed 📖 ~4 min read  •  Source: SUSE security advisory (see also SUSE bugzilla) Related CVEs: CVE-2017-16840 CVE-2025-63757 CVE-2025-59728 CVE-2022-48434 CVE-2024-7055 CVE-2024-7272 CVE-2023-50009 CVE-2023-50010  +12 more Upstream summary: The VC-2 Video Compression encoder in FFmpeg 3.0 and 3.4 allows remote attackers […]