Suse Manager Proxy vulnerabilities

19 CVEs affecting Suse Manager Proxy, 5 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-31431, published 2026-04-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-4034: Red Hat Polkit Out-of-Bounds Read and Write Vulnerability, published 2022-01-28. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-06-27. EPSS: 94.9% chance of exploitation in the next 30 days. A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users…
CVE-2016-3427: Oracle Java SE and JRockit Unspecified Vulnerability, published 2016-04-21. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 92.3% chance of exploitation in the next 30 days. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via…
CVE-2016-3718: ImageMagick Server-Side Request Forgery (SSRF) Vulnerability, published 2016-05-05. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 75.7% chance of exploitation in the next 30 days. The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
CVE-2016-3715: ImageMagick Arbitrary File Deletion Vulnerability, published 2016-05-05. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 75.3% chance of exploitation in the next 30 days. The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability, published 2026-04-22. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-05-01. EPSS: 3.4% chance of exploitation in the next 30 days. In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the…
CVE-2016-1286, published 2016-03-09. High severity, CVSS 8.6. EPSS: 62.1% chance of exploitation in the next 30 days. named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME…
CVE-2016-1285, published 2016-03-09. Medium severity, CVSS 6.8. EPSS: 59.1% chance of exploitation in the next 30 days. named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service…
CVE-2016-4957, published 2016-07-05. High severity, CVSS 7.5. EPSS: 44.9% chance of exploitation in the next 30 days. ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547.
CVE-2016-4953, published 2016-07-05. High severity, CVSS 7.5. EPSS: 17.2% chance of exploitation in the next 30 days. ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK packet with incorrect authentication data at…
CVE-2016-4956, published 2016-07-05. Medium severity, CVSS 5.3. EPSS: 16.4% chance of exploitation in the next 30 days. ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists…

Latest

CVE-2022-27239, published 2022-04-27. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges.
CVE-2015-5300, published 2017-07-21. High severity, CVSS 7.5. EPSS: 9.1% chance of exploitation in the next 30 days. The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to…
CVE-2015-5219, published 2017-07-21. High severity, CVSS 7.5. EPSS: 6.1% chance of exploitation in the next 30 days. The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service…
CVE-2015-5194, published 2017-07-21. High severity, CVSS 7.5. EPSS: 6.5% chance of exploitation in the next 30 days. The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.
CVE-2017-7995, published 2017-05-03. Low severity, CVSS 3.8. EPSS: 0.4% chance of exploitation in the next 30 days. Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to information disclosure. This is an error in…
CVE-2015-7976, published 2017-01-30. Medium severity, CVSS 4.3. EPSS: 3.6% chance of exploitation in the next 30 days. The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a…