openSUSE Tumbleweed

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: openSUSE Tumbleweed 📖 ~4 min read  •  Source: SUSE security advisory (see also SUSE bugzilla) Related CVEs: CVE-2015-5738 CVE-2021-3345 CVE-2021-33560 CVE-2024-2236 CVE-2021-40528 CVE-2013-4242 CVE-2014-3591 CVE-2015-0837  +6 more Upstream summary: The RSA-CRT implementation in the Cavium Software Development Kit (SDK) 2.x, when used […]

🟡 Medium   ⏱ 10–30 min  Last verified: 25 May 2026 Affected versions: openSUSE Tumbleweed 📖 ~4 min read  •  Source: SUSE security advisory (see also SUSE bugzilla) Related CVEs: CVE-2024-24557 Upstream summary: Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning […]

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: openSUSE Tumbleweed 📖 ~4 min read  •  Source: SUSE advisory openSUSE-SU-2024:0224-2 (see also SUSE bugzilla) Related CVEs: CVE-2024-24792 CVE-2023-29408 Upstream summary: Parsing a corrupt or malicious image with invalid color indices can cause a panic. Table of contents Symptom & Impact Environment […]

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: openSUSE Tumbleweed 📖 ~4 min read  •  Source: SUSE advisory openSUSE-SU-2025:14815-1 (see also SUSE bugzilla) Related CVEs: CVE-2024-45339 CVE-2021-20329 Upstream summary: When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path […]

🟡 Medium   ⏱ 10–30 min  Last verified: 25 May 2026 Affected versions: openSUSE Tumbleweed 📖 ~4 min read  •  Source: SUSE security advisory (see also SUSE bugzilla) Related CVEs: CVE-2024-28102 Upstream summary: JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to version 1.5.6, an attacker can cause a denial of service attack […]

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: openSUSE Tumbleweed 📖 ~4 min read  •  Source: SUSE advisory SUSE-SU-2024:1396-1 (see also SUSE bugzilla) Related CVEs: CVE-2024-31744 CVE-2015-5203 CVE-2015-5221 CVE-2016-1577 CVE-2016-8654 CVE-2016-9262 CVE-2016-9560 CVE-2020-27828  +12 more Upstream summary: In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, […]

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: openSUSE Tumbleweed 📖 ~4 min read  •  Source: SUSE security advisory (see also SUSE bugzilla) Related CVEs: CVE-2024-48208 CVE-2019-20176 CVE-2021-40524 CVE-2020-9274 CVE-2020-9365 CVE-2011-0411 CVE-2011-0418 Upstream summary: pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. There is an out of bounds read in […]

🟢 Low   ⏱ 5–15 min  Last verified: 25 May 2026 Affected versions: openSUSE Tumbleweed 📖 ~4 min read  •  Source: SUSE advisory openSUSE-SU-2025:14668-1 (see also SUSE bugzilla) Related CVEs: CVE-2024-54133 Upstream summary: Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in […]

🟡 Medium   ⏱ 10–30 min  Last verified: 25 May 2026 Affected versions: openSUSE Tumbleweed 📖 ~4 min read  •  Source: SUSE security advisory (see also SUSE bugzilla) Related CVEs: CVE-2024-1681 Upstream summary: corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into […]

🟠 High   ⏱ 15–60 min  Last verified: 25 May 2026 Affected versions: openSUSE Tumbleweed 📖 ~4 min read  •  Source: SUSE advisory openSUSE-SU-2024:14417-1 (see also SUSE bugzilla) Related CVEs: CVE-2024-47874 Upstream summary: Starlette is an Asynchronous Server Gateway Interface (ASGI) framework/toolkit. Prior to version 0.40.0, Starlette treats `multipart/form-data` parts without a `filename` as text […]