suse

Latest CVEs · RSS

• CVE-2026-104618 2026-10-15 · CVSS 6.2
  On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means t
• CVE-2026-104617 2026-10-15 · CVSS 5.1
  There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for arbitrar
• CVE-2023-32198 2026-10-15 · CVSS 8.0
  A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote serv
• CVE-2024-22031 2026-10-15 · CVSS 8.5
  A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same n
• CVE-2025-23390 2026-10-15 · CVSS 6.3
  A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if
• CVE-2026-88804 2026-09-28 · CVSS 9.6
  An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Ran
• CVE-2026-88805 2026-09-28 · CVSS 8.1
  Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Ran
• CVE-2026-88808 2026-09-28 · CVSS 8.8
  A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials
• CVE-2026-93540 2026-09-28 · CVSS 6.5
  A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, t
• CVE-2026-93539 2026-09-28 · CVSS 5.4
  A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests
• CVE-2026-93538 2026-09-28 · CVSS 7.1
  A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering
• CVE-2026-93537 2026-09-28 · CVSS 6.5
  A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or m
• CVE-2026-78424 2026-09-28 · CVSS 8.8
  Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to Neu
• CVE-2026-94287 2026-09-28 · CVSS 5.5
  A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memo
• CVE-2026-94286 2026-09-28 · CVSS 7.1
  An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.
• CVE-2026-94285 2026-09-28 · CVSS 5.1
  An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.
• CVE-2026-94284 2026-09-28 · CVSS 5.5
  An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attach
• CVE-2026-94283 2026-09-28 · CVSS 6.5
  An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash atta
• CVE-2026-94282 2026-09-28 · CVSS 5.6
  An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client
• CVE-2026-94281 2026-09-24 · CVSS 6.5
  An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
• CVE-2026-93545 2026-09-24 · CVSS 6.5
  An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
• CVE-2026-93544 2026-09-24 · CVSS 6.5
  An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client.
• CVE-2026-93543 2026-09-24 · CVSS 7.4
  An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.
• CVE-2026-93542 2026-09-24 · CVSS 6.5
  An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X
• CVE-2026-93541 2026-09-24 · CVSS 6.5
  An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a