https://vulnogram.org/ Most recent CVEs assigned by SUSE (suse). https://vulnogram.org/seaview/icons/suse.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-104618 https://vulnogram.org/CVE-2026-104618 On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it. Medium Thu, 15 Oct 2026 08:41:31 GMT https://vulnogram.org/CVE-2026-104617 https://vulnogram.org/CVE-2026-104617 There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for arbitrary low-privileged users in the system. Medium Thu, 15 Oct 2026 08:33:09 GMT https://vulnogram.org/CVE-2023-32198 https://vulnogram.org/CVE-2023-32198 A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middl… High Thu, 15 Oct 2026 08:22:47 GMT https://vulnogram.org/CVE-2024-22031 https://vulnogram.org/CVE-2024-22031 A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with the same name as an existing project in a different cluster. This results in the user gaining access… High Thu, 15 Oct 2026 08:21:02 GMT https://vulnogram.org/CVE-2025-23390 https://vulnogram.org/CVE-2025-23390 A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the execution of a m… Medium Thu, 15 Oct 2026 08:16:46 GMT https://vulnogram.org/CVE-2026-88804 https://vulnogram.org/CVE-2026-88804 An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and… Critical Network Exploitable Mon, 28 Sep 2026 15:58:34 GMT https://vulnogram.org/CVE-2026-88805 https://vulnogram.org/CVE-2026-88805 Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2. High Network Exploitable Mon, 28 Sep 2026 15:50:34 GMT https://vulnogram.org/CVE-2026-88808 https://vulnogram.org/CVE-2026-88808 A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environme… High Mon, 28 Sep 2026 15:36:13 GMT https://vulnogram.org/CVE-2026-93540 https://vulnogram.org/CVE-2026-93540 A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the re… Medium Mon, 28 Sep 2026 14:45:42 GMT https://vulnogram.org/CVE-2026-93539 https://vulnogram.org/CVE-2026-93539 A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInt… Medium Mon, 28 Sep 2026 14:19:55 GMT https://vulnogram.org/CVE-2026-93538 https://vulnogram.org/CVE-2026-93538 A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the clust… High Mon, 28 Sep 2026 14:10:21 GMT https://vulnogram.org/CVE-2026-93537 https://vulnogram.org/CVE-2026-93537 A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the env… Medium Mon, 28 Sep 2026 13:29:10 GMT https://vulnogram.org/CVE-2026-78424 https://vulnogram.org/CVE-2026-78424 Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privi… High Mon, 28 Sep 2026 11:44:05 GMT https://vulnogram.org/CVE-2026-94287 https://vulnogram.org/CVE-2026-94287 A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion. Medium Mon, 28 Sep 2026 08:57:24 GMT https://vulnogram.org/CVE-2026-94286 https://vulnogram.org/CVE-2026-94286 An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients. High Network Exploitable Mon, 28 Sep 2026 08:50:35 GMT https://vulnogram.org/CVE-2026-94285 https://vulnogram.org/CVE-2026-94285 An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients. Medium Mon, 28 Sep 2026 08:45:47 GMT https://vulnogram.org/CVE-2026-94284 https://vulnogram.org/CVE-2026-94284 An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients. Medium Mon, 28 Sep 2026 08:42:56 GMT https://vulnogram.org/CVE-2026-94283 https://vulnogram.org/CVE-2026-94283 An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients. Medium Network Exploitable Mon, 28 Sep 2026 08:34:14 GMT https://vulnogram.org/CVE-2026-94282 https://vulnogram.org/CVE-2026-94282 An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client. Medium Mon, 28 Sep 2026 08:18:13 GMT https://vulnogram.org/CVE-2026-94281 https://vulnogram.org/CVE-2026-94281 An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. Medium Network Exploitable Thu, 24 Sep 2026 16:23:50 GMT https://vulnogram.org/CVE-2026-93545 https://vulnogram.org/CVE-2026-93545 An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. Medium Network Exploitable Thu, 24 Sep 2026 16:20:35 GMT https://vulnogram.org/CVE-2026-93544 https://vulnogram.org/CVE-2026-93544 An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client. Medium Network Exploitable Thu, 24 Sep 2026 16:13:29 GMT https://vulnogram.org/CVE-2026-93543 https://vulnogram.org/CVE-2026-93543 An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. High Network Exploitable Thu, 24 Sep 2026 16:09:51 GMT https://vulnogram.org/CVE-2026-93542 https://vulnogram.org/CVE-2026-93542 An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X client. Medium Network Exploitable Thu, 24 Sep 2026 16:03:00 GMT https://vulnogram.org/CVE-2026-93541 https://vulnogram.org/CVE-2026-93541 An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a Medium Network Exploitable Thu, 24 Sep 2026 15:58:58 GMT https://vulnogram.org/CVE-2026-88807 https://vulnogram.org/CVE-2026-88807 A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients. High Network Exploitable Mon, 21 Sep 2026 13:49:21 GMT https://vulnogram.org/CVE-2026-88806 https://vulnogram.org/CVE-2026-88806 A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map. High Network Exploitable Mon, 21 Sep 2026 13:42:12 GMT https://vulnogram.org/CVE-2026-78427 https://vulnogram.org/CVE-2026-78427 The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable… Medium Thu, 17 Sep 2026 09:33:26 GMT https://vulnogram.org/CVE-2026-78425 https://vulnogram.org/CVE-2026-78425 Authorised users of outside applications behind the same corporate identity provider (IdP), for example, a wiki, a ticketing system, an expenses tool, or anything they legitimately hold an account on can log into their system via SAML SSO. The IdP is… High Thu, 17 Sep 2026 09:32:21 GMT https://vulnogram.org/CVE-2026-78426 https://vulnogram.org/CVE-2026-78426 The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expired token with equivalent spell… Low Thu, 17 Sep 2026 09:28:19 GMT https://vulnogram.org/CVE-2026-78428 https://vulnogram.org/CVE-2026-78428 For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently High Network Exploitable Thu, 17 Sep 2026 09:19:21 GMT https://vulnogram.org/CVE-2026-44940 https://vulnogram.org/CVE-2026-44940 The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecure locations rather than managing them securely. An attacker with minimal access could obtain the token to gain unauthorized acces… Medium Thu, 17 Sep 2026 06:43:19 GMT https://vulnogram.org/CVE-2026-44950 https://vulnogram.org/CVE-2026-44950 fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap into a single buffer. Existing checks validates only that the source slice (position, length) lies within the source bitmap buffer. It does not check wh… Critical Network Exploitable Thu, 10 Sep 2026 08:19:55 GMT https://vulnogram.org/CVE-2026-59679 https://vulnogram.org/CVE-2026-59679 fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_… Critical Network Exploitable Thu, 10 Sep 2026 08:15:24 GMT https://vulnogram.org/CVE-2025-46808 https://vulnogram.org/CVE-2025-46808 An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive information into the manager container’s log This issue affects neuvector: before 5.4.5. Medium Wed, 09 Sep 2026 08:25:42 GMT https://vulnogram.org/CVE-2026-75036 https://vulnogram.org/CVE-2026-75036 A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository refere… Medium Thu, 03 Sep 2026 15:15:25 GMT https://vulnogram.org/CVE-2026-75035 https://vulnogram.org/CVE-2026-75035 A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user c… High Thu, 03 Sep 2026 15:07:11 GMT https://vulnogram.org/CVE-2026-75034 https://vulnogram.org/CVE-2026-75034 A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-avai… High Network Exploitable Thu, 03 Sep 2026 15:01:16 GMT https://vulnogram.org/CVE-2026-75033 https://vulnogram.org/CVE-2026-75033 A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to crea… High Thu, 03 Sep 2026 14:57:34 GMT https://vulnogram.org/CVE-2026-71404 https://vulnogram.org/CVE-2026-71404 A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name` annotation and overwrote that object's rules without verifying ownership. A user with deleg… High Thu, 03 Sep 2026 14:51:44 GMT https://vulnogram.org/CVE-2026-71403 https://vulnogram.org/CVE-2026-71403 A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `username` and `principalIds` fields. A user holding the `update` verb on `users.management.cattle.io` could inject a foreign identity pr… Medium Thu, 03 Sep 2026 14:45:37 GMT https://vulnogram.org/CVE-2026-25706 https://vulnogram.org/CVE-2026-25706 Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an Active Directory directory tree - a rogue domain controller, or a directory user delegated the right to create o… High Network Exploitable Tue, 01 Sep 2026 09:51:22 GMT https://vulnogram.org/CVE-2026-59681 https://vulnogram.org/CVE-2026-59681 A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host. Auth::AuthConf in src/lib/auth/authconf.rb assembles the Sam… High Network Exploitable Tue, 01 Sep 2026 09:38:15 GMT https://vulnogram.org/CVE-2026-59680 https://vulnogram.org/CVE-2026-59680 An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, get_password_term() in src/include/users/dialogs.rb read the shadowLastChange and shadowExpire fields with GetString(), which perfo… High Tue, 01 Sep 2026 09:20:45 GMT https://vulnogram.org/CVE-2026-78422 https://vulnogram.org/CVE-2026-78422 Subject::new_for_owner() in the zbus_polkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer (D-Bus type u), whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer (D-Bus… High Mon, 31 Aug 2026 14:14:13 GMT https://vulnogram.org/CVE-2026-71402 https://vulnogram.org/CVE-2026-71402 An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c reports the IP total length as the payload length instead of the length of the remaining UDP payload. Consequently, the DHCP… Medium Thu, 27 Aug 2026 15:09:41 GMT https://vulnogram.org/CVE-2026-71401 https://vulnogram.org/CVE-2026-71401 An integer underflow was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c does not verify that the IP total length field (ip_len) is at least as large as the IP header length (ihl) before subtracting… Medium Thu, 27 Aug 2026 15:01:27 GMT https://vulnogram.org/CVE-2026-18794 https://vulnogram.org/CVE-2026-18794 The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data. High Network Exploitable Wed, 26 Aug 2026 09:29:57 GMT https://vulnogram.org/CVE-2026-59683 https://vulnogram.org/CVE-2026-59683 The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of CVE-2026-59682). This allows either a full system compromise from local or remote (if the daemon is running as root) or a full acc… Critical Network Exploitable Wed, 26 Aug 2026 09:24:42 GMT https://vulnogram.org/CVE-2026-59682 https://vulnogram.org/CVE-2026-59682 Arbitrary file overwrite via SAVE_PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3. Critical Network Exploitable Wed, 26 Aug 2026 09:13:22 GMT