[ Vendor · 53 CVEs ]
Suse
CVEs affecting Suse published in the last 30 days, plus any Suse CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-104617 | 15 Oct 2026 | CVSS 5.1 | SUSE Linux Enterprise Server 16.1There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible… | |
| CVE-2026-104618 | 15 Oct 2026 | CVSS 6.2 | SUSE Linux Enterprise Server 16.1On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however… | |
| CVE-2024-22031 | 15 Oct 2026 | CVSS 8.5 | SUSE rancherA vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with… | |
| CVE-2025-23390 | 15 Oct 2026 | CVSS 6.3 | SUSE fleetA vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting… | |
| CVE-2023-32198 | 15 Oct 2026 | CVSS 8.0 | SUSE steveA vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the… | |
| CVE-2026-88805 | 28 Sep 2026 | CVSS 8.1 | SUSE RancherIncorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected… | |
| CVE-2026-88808 | 28 Sep 2026 | CVSS 8.8 | SUSE RancherA vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin… | |
| CVE-2026-88804 | 28 Sep 2026 | CVSS 9.6 | SUSE RancherAn unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI… | |
| CVE-2026-93539 | 28 Sep 2026 | CVSS 5.4 | SUSE RancherA vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming… | |
| CVE-2026-93540 | 28 Sep 2026 | CVSS 6.5 | SUSE RancherA privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations… | |
| CVE-2026-93538 | 28 Sep 2026 | CVSS 7.1 | SUSE RancherA cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the… | |
| CVE-2026-93537 | 28 Sep 2026 | CVSS 6.5 | SUSE RancherA user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to… | |
| CVE-2026-78424 | 28 Sep 2026 | CVSS 8.8 | SUSE NeuVectorImproper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with… | |
| CVE-2023-29552 | 25 Apr 2023 | CVSS 7.5 | Service Location Protocol (SLP) Denial-of-ServiceThe Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the… | Exploited |
| CVE-2016-4171 | 16 Jun 2016 | CVSS 9.8 | Adobe Flash Player Remote Code ExecutionUnspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as… | Exploited |
| CVE-2016-4117 | 11 May 2016 | CVSS 9.8 | Adobe Flash Player Arbitrary Code ExecutionAdobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May… | Exploited |
| CVE-2016-3714 | 5 May 2016 | CVSS 8.4 | ImageMagick Improper Input ValidationThe (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1… | ExploitedFix |
| CVE-2016-1646 | 29 Mar 2016 | CVSS 8.8 | Google Chromium V8 Out-of-Bounds ReadThe Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider… | ExploitedFix |
| CVE-2016-0752 | 16 Feb 2016 | CVSS 7.5 | Ruby on Rails Directory TraversalDirectory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x… | Exploited |
| CVE-2015-8651 | 28 Dec 2015 | CVSS 8.8 | Adobe Flash Player Integer OverflowInteger overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux… | ExploitedFix |
| CVE-2015-4902 | 22 Oct 2015 | CVSS 5.3 | Oracle Java SE Integrity CheckUnspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to… | ExploitedFix |
| CVE-2015-7645 | 15 Oct 2015 | CVSS 7.8 | Adobe Flash Player Arbitrary Code ExecutionAdobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote… | ExploitedFix |
| CVE-2015-4495 | 8 Aug 2015 | CVSS 8.8 | Mozilla Firefox Security Feature BypassThe PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same… | ExploitedFix |
| CVE-2015-5477 | 29 Jul 2015 | CVSS 7.5 | Crafted TKEY queries crash ISC BIND DNS serversnamed in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and… | ExploitedFix |
| CVE-2015-2590 | 16 Jul 2015 | CVSS 9.8 | Oracle Java SE and Java SE Embedded Remote Code ExecutionUnspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect… | ExploitedFix |
| CVE-2015-5123 | 14 Jul 2015 | CVSS 9.8 | Adobe Flash Player Use-After-FreeUse-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on… | Exploited |
| CVE-2015-5122 | 14 Jul 2015 | CVSS 9.8 | Adobe Flash Player Use-After-FreeUse-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on… | Exploited |
| CVE-2015-5119 | 8 Jul 2015 | CVSS 9.8 | Adobe Flash Player Use-After-FreeUse-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x… | ExploitedFix |
| CVE-2015-3113 | 23 Jun 2015 | CVSS 9.8 | Adobe Flash Player Heap-Based Buffer OverflowHeap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before… | ExploitedFix |
| CVE-2015-3306 | 18 May 2015 | CVSS 10.0 | ProFTPD mod_copy lets anyone copy files on the serverThe mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. | Exploited |
| CVE-2015-0313 | 2 Feb 2015 | CVSS 9.8 | Adobe Flash Player Use-After-FreeUse-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before… | ExploitedFix |
| CVE-2015-0311 | 23 Jan 2015 | CVSS 9.8 | Adobe Flash Player Remote Code ExecutionUnspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through… | ExploitedFix |
| CVE-2014-7169 | 25 Sep 2014 | CVSS 9.8 | GNU Bourne-Again Shell (Bash) Arbitrary Code ExecutionGNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which… | ExploitedFix |
| CVE-2014-6271 | 24 Sep 2014 | CVSS 9.8 | GNU Bourne-Again Shell (Bash) Arbitrary Code ExecutionGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to… | ExploitedFix |
| CVE-2014-3153 | 7 Jun 2014 | CVSS 7.8 | Linux Kernel Privilege EscalationThe futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which… | ExploitedFix |
| CVE-2014-0196 | 7 May 2014 | CVSS 5.5 | Linux Kernel Race ConditionThe n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST"… | ExploitedFix |
| CVE-2013-1690 | 26 Jun 2013 | CVSS 8.8 | Mozilla Firefox and Thunderbird Denial-of-ServiceMozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle… | Exploited |
| CVE-2013-2465 | 18 Jun 2013 | CVSS 9.8 | Oracle Java SE UnspecifiedUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0… | ExploitedFix |
| CVE-2013-2729 | 16 May 2013 | CVSS 9.8 | Adobe Reader and Acrobat Arbitrary Integer OverflowInteger overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code… | ExploitedFix |
| CVE-2013-0648 | 27 Feb 2013 | CVSS 8.8 | Adobe Flash Player Code ExecutionUnspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171… | ExploitedFix |
| CVE-2013-0640 | 14 Feb 2013 | CVSS 7.8 | Adobe Reader and Acrobat Memory CorruptionAdobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a… | Exploited |
| CVE-2013-0641 | 14 Feb 2013 | CVSS 7.8 | Adobe Reader Buffer OverflowBuffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute… | Exploited |
| CVE-2012-5076 | 16 Oct 2012 | CVSS 9.8 | Oracle Java SE Sandbox BypassUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect… | ExploitedFix |
| CVE-2012-1535 | 15 Aug 2012 | CVSS 7.8 | Adobe Flash Player Arbitrary Code ExecutionUnspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers… | ExploitedFix |
| CVE-2012-2034 | 9 Jun 2012 | CVSS 7.5 | Adobe Flash Player Memory CorruptionAdobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux… | Exploited |
| CVE-2012-0507 | 7 Jun 2012 | CVSS 9.8 | Oracle Java SE Runtime Environment (JRE) Arbitrary Code ExecutionUnspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0… | Exploited |
| CVE-2012-1823 | 11 May 2012 | CVSS 9.8 | PHP-CGI Query String Parametersapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query… | ExploitedFix |
| CVE-2011-3544 | 19 Oct 2011 | CVSS 9.8 | Oracle Java SE Runtime Environment (JRE) Arbitrary Code ExecutionUnspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote… | ExploitedFix |
| CVE-2011-0609 | 15 Mar 2011 | CVSS 7.8 | Adobe Flash Player UnspecifiedUnspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android… | Exploited |
| CVE-2010-3904 | 6 Dec 2010 | CVSS 7.8 | Linux Kernel Improper Input ValidationThe rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36… | ExploitedFix |
| CVE-2010-1297 | 8 Jun 2010 | CVSS 7.8 | Adobe Flash Player Memory CorruptionAdobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x… | Exploited |
| CVE-2009-3953 | 13 Jan 2010 | CVSS 8.8 | Adobe Acrobat and Reader Universal 3D Remote Code ExecutionThe U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote… | ExploitedFix |
| CVE-2009-4324 | 15 Dec 2009 | CVSS 7.8 | Adobe Acrobat and Reader Use-After-FreeUse-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on… | Exploited |