Suse Opensuse Tumbleweed vulnerabilities

12 CVEs affecting Suse Opensuse Tumbleweed, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-59679, published 2026-09-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-22033, published 2024-10-16. Medium severity, CVSS 6.3. EPSS: 0.9% chance of exploitation in the next 30 days. The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that allowed to execute command in later steps
CVE-2025-23394, published 2025-05-26. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed cyrus-imapd before 3.8.4-2.1.
CVE-2024-49504, published 2024-11-13. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.
CVE-2026-44950, published 2026-09-10. Critical severity, CVSS 9.0. EPSS: 0.3% chance of exploitation in the next 30 days. fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies…
CVE-2026-59679, published 2026-09-10. Critical severity, CVSS 9.0. EPSS: 0.3% chance of exploitation in the next 30 days. fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with…
CVE-2024-22034, published 2024-10-16. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim
CVE-2023-32190, published 2024-10-16. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable by abusing insecure file operations that run with root privileges.
CVE-2024-22029, published 2024-10-16. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root
CVE-2026-59674, published 2026-07-14. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user to escalate to root. This issue affects openSUSE Tumbleweed: from ?…
CVE-2025-23386, published 2025-04-10. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed package gerbera allows the service user gerbera to escalate to root.,This issue affects gerbera on openSUSE Tumbleweed before…

Latest

CVE-2026-41051, published 2026-05-13. Medium severity, CVSS 5.0. EPSS: 0.1% chance of exploitation in the next 30 days. csync2 uses insecure temporary directories when compiled with C99 or later, allowing for TOCTOU style attacks on the temporary directories.
CVE-2025-53882, published 2025-07-23. Medium severity, CVSS 4.4. EPSS: 0.1% chance of exploitation in the next 30 days. A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSE mailman3 package allows the mailman user to sent SIGHUP to arbitrary processes. This…