govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2025:15405-1 Final 1 1 2025-08-04T00:00:00Z current 2025-08-04T00:00:00Z 2025-08-04T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media These are all security issues fixed in the govulncheck-vulndb-0.0.20250730T213748-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2025-15405 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2024-44905/ SUSE CVE CVE-2024-44905 page https://www.suse.com/security/cve/CVE-2024-44906/ SUSE CVE CVE-2024-44906 page https://www.suse.com/security/cve/CVE-2024-56731/ SUSE CVE CVE-2024-56731 page https://www.suse.com/security/cve/CVE-2025-0928/ SUSE CVE CVE-2025-0928 page https://www.suse.com/security/cve/CVE-2025-1088/ SUSE CVE CVE-2025-1088 page https://www.suse.com/security/cve/CVE-2025-30086/ SUSE CVE CVE-2025-30086 page https://www.suse.com/security/cve/CVE-2025-32019/ SUSE CVE CVE-2025-32019 page https://www.suse.com/security/cve/CVE-2025-3227/ SUSE CVE CVE-2025-3227 page https://www.suse.com/security/cve/CVE-2025-3228/ SUSE CVE CVE-2025-3228 page https://www.suse.com/security/cve/CVE-2025-3415/ SUSE CVE CVE-2025-3415 page https://www.suse.com/security/cve/CVE-2025-4563/ SUSE CVE CVE-2025-4563 page https://www.suse.com/security/cve/CVE-2025-4656/ SUSE CVE CVE-2025-4656 page https://www.suse.com/security/cve/CVE-2025-46702/ SUSE CVE CVE-2025-46702 page https://www.suse.com/security/cve/CVE-2025-4674/ SUSE CVE CVE-2025-4674 page https://www.suse.com/security/cve/CVE-2025-47281/ SUSE CVE CVE-2025-47281 page https://www.suse.com/security/cve/CVE-2025-47871/ SUSE CVE CVE-2025-47871 page https://www.suse.com/security/cve/CVE-2025-47943/ SUSE CVE CVE-2025-47943 page https://www.suse.com/security/cve/CVE-2025-4922/ SUSE CVE CVE-2025-4922 page https://www.suse.com/security/cve/CVE-2025-4981/ SUSE CVE CVE-2025-4981 page https://www.suse.com/security/cve/CVE-2025-49825/ SUSE CVE CVE-2025-49825 page https://www.suse.com/security/cve/CVE-2025-5030/ SUSE CVE CVE-2025-5030 page https://www.suse.com/security/cve/CVE-2025-51471/ SUSE CVE CVE-2025-51471 page https://www.suse.com/security/cve/CVE-2025-52477/ SUSE CVE CVE-2025-52477 page https://www.suse.com/security/cve/CVE-2025-52889/ SUSE CVE CVE-2025-52889 page https://www.suse.com/security/cve/CVE-2025-52890/ SUSE CVE CVE-2025-52890 page https://www.suse.com/security/cve/CVE-2025-52893/ SUSE CVE CVE-2025-52893 page https://www.suse.com/security/cve/CVE-2025-52894/ SUSE CVE CVE-2025-52894 page https://www.suse.com/security/cve/CVE-2025-52900/ SUSE CVE CVE-2025-52900 page https://www.suse.com/security/cve/CVE-2025-52901/ SUSE CVE CVE-2025-52901 page https://www.suse.com/security/cve/CVE-2025-52902/ SUSE CVE CVE-2025-52902 page https://www.suse.com/security/cve/CVE-2025-52903/ SUSE CVE CVE-2025-52903 page https://www.suse.com/security/cve/CVE-2025-52904/ SUSE CVE CVE-2025-52904 page https://www.suse.com/security/cve/CVE-2025-52995/ SUSE CVE CVE-2025-52995 page https://www.suse.com/security/cve/CVE-2025-52996/ SUSE CVE CVE-2025-52996 page https://www.suse.com/security/cve/CVE-2025-52997/ SUSE CVE CVE-2025-52997 page https://www.suse.com/security/cve/CVE-2025-53512/ SUSE CVE CVE-2025-53512 page https://www.suse.com/security/cve/CVE-2025-53513/ SUSE CVE CVE-2025-53513 page https://www.suse.com/security/cve/CVE-2025-53547/ SUSE CVE CVE-2025-53547 page https://www.suse.com/security/cve/CVE-2025-53632/ SUSE CVE CVE-2025-53632 page https://www.suse.com/security/cve/CVE-2025-53633/ SUSE CVE CVE-2025-53633 page https://www.suse.com/security/cve/CVE-2025-53634/ SUSE CVE CVE-2025-53634 page https://www.suse.com/security/cve/CVE-2025-53826/ SUSE CVE CVE-2025-53826 page https://www.suse.com/security/cve/CVE-2025-53893/ SUSE CVE CVE-2025-53893 page https://www.suse.com/security/cve/CVE-2025-53945/ SUSE CVE CVE-2025-53945 page https://www.suse.com/security/cve/CVE-2025-54059/ SUSE CVE CVE-2025-54059 page https://www.suse.com/security/cve/CVE-2025-54379/ SUSE CVE CVE-2025-54379 page https://www.suse.com/security/cve/CVE-2025-5689/ SUSE CVE CVE-2025-5689 page https://www.suse.com/security/cve/CVE-2025-5981/ SUSE CVE CVE-2025-5981 page https://www.suse.com/security/cve/CVE-2025-6023/ SUSE CVE CVE-2025-6023 page https://www.suse.com/security/cve/CVE-2025-6032/ SUSE CVE CVE-2025-6032 page https://www.suse.com/security/cve/CVE-2025-6224/ SUSE CVE CVE-2025-6224 page https://www.suse.com/security/cve/CVE-2025-6226/ SUSE CVE CVE-2025-6226 page https://www.suse.com/security/cve/CVE-2025-6227/ SUSE CVE CVE-2025-6227 page https://www.suse.com/security/cve/CVE-2025-6233/ SUSE CVE CVE-2025-6233 page https://www.suse.com/security/cve/CVE-2025-6264/ SUSE CVE CVE-2025-6264 page https://www.suse.com/security/cve/CVE-2025-6624/ SUSE CVE CVE-2025-6624 page openSUSE Tumbleweed govulncheck-vulndb-0.0.20250730T213748-1.1 govulncheck-vulndb-0.0.20250730T213748-1.1 as a component of openSUSE Tumbleweed go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/append_value.go. CVE-2024-44905 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-44905.html CVE-2024-44905 uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go. The maintainer has stated that the issue is fixed in v1.2.15. CVE-2024-44906 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-44906.html CVE-2024-44906 Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931. Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUN_USER in the configuration. Allowing attackers to access and alter any users' code hosted on the same instance. This issue has been patched in version 0.13.3. CVE-2024-56731 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-56731.html CVE-2024-56731 In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller itself, without verifying model membership or requiring explicit permissions. This enabled the distribution of poisoned binaries to new or upgraded machines, potentially resulting in remote code execution. CVE-2025-0928 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-0928.html CVE-2025-0928 In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher. CVE-2025-1088 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-1088.html CVE-2025-1088 https://bugzilla.suse.com/1245224 SUSE Bug 1245224 CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/users endpoint to leak users' password hash and salt values. The q URL parameter allows a user to filter users by any column, and filter password=~ could be abused to leak out a user's password hash character by character. An attacker with administrator access could exploit this to leak highly sensitive information stored in the Harbor database. All endpoints that support the q URL parameter are vulnerable to this ORM leak attack. CVE-2025-30086 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-30086.html CVE-2025-30086 Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3. CVE-2025-32019 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-32019.html CVE-2025-32019 Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public and private channels by manipulating playbook run participants when the run is linked to a channel. CVE-2025-3227 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-3227.html CVE-2025-3227 Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly retrieve requestorInfo from playbooks handler for guest users which allows an attacker access to the playbook run. CVE-2025-3228 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-3228.html CVE-2025-3228 Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01 CVE-2025-3415 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-3415.html CVE-2025-3415 https://bugzilla.suse.com/1245302 SUSE Bug 1245302 A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation. CVE-2025-4563 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-4563.html CVE-2025-4563 https://bugzilla.suse.com/1245185 SUSE Bug 1245185 Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22. CVE-2025-4656 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-4656.html CVE-2025-4656 Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions when adding participants to playbook runs. This allows authenticated users with member-level permissions to bypass system admin restrictions and add or remove users to/from private channels via the playbook run participants feature, even when the 'Manage Members' permission has been explicitly removed. This can lead to unauthorized access to sensitive channel content and allow guest users to gain channel management privileges. CVE-2025-46702 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-46702.html CVE-2025-46702 The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected. CVE-2025-4674 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-4674.html CVE-2025-4674 https://bugzilla.suse.com/1246118 SUSE Bug 1246118 Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service (DoS) vulnerability exists due to improper handling of JMESPath variable substitutions. Attackers with permissions to create or update Kyverno policies can craft expressions using the {{@}} variable combined with a pipe and an invalid JMESPath function (e.g., {{@ | non_existent_function }}). This leads to a nil value being substituted into the policy structure. Subsequent processing by internal functions, specifically getValueAsStringMap, which expect string values, results in a panic due to a type assertion failure (interface {} is nil, not string). This crashes Kyverno worker threads in the admission controller and causes continuous crashes of the reports controller pod. This is fixed in version 1.14.2. CVE-2025-47281 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-47281.html CVE-2025-47281 Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly validate channel membership when retrieving playbook run metadata, allowing authenticated users who are playbook members but not channel members to access sensitive information about linked private channels including channel name, display name, and participant count through the run metadata API endpoint. CVE-2025-47871 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-47871.html CVE-2025-47871 Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-site scripting (XSS) vulnerability present in Gogs, which allows client-side Javascript code execution. The vulnerability is caused by the usage of a vulnerable and outdated component: pdfjs-1.4.20 under public/plugins/. This issue has been fixed for gogs.io/gogs in version 0.13.3. CVE-2025-47943 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-47943.html CVE-2025-47943 Nomad Community and Nomad Enterprise ("Nomad") prefix-based ACL policy lookup can lead to incorrect rule application and shadowing. This vulnerability, identified as CVE-2025-4922, is fixed in Nomad Community Edition 1.10.2 and Nomad Enterprise 1.10.2, 1.9.10, and 1.8.14. CVE-2025-4922 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-4922.html CVE-2025-4922 Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in the archive extractor which allows authenticated users to write files to arbitrary locations on the filesystem via uploading archives with path traversal sequences in filenames, potentially leading to remote code execution. The vulnerability impacts instances where file uploads and document search by content is enabled (FileSettings.EnableFileAttachments = true and FileSettings.ExtractContent = true). These configuration settings are enabled by default. CVE-2025-4981 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-4981.html CVE-2025-4981 Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch. CVE-2025-49825 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-49825.html CVE-2025-49825 https://bugzilla.suse.com/1244718 SUSE Bug 1244718 A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been declared as critical. This vulnerability affects the function processFile of the file internal/unpack/unpack.go of the component wxapkg File Parser. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. CVE-2025-5030 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-5030.html CVE-2025-5030 Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint. CVE-2025-51471 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-51471.html CVE-2025-51471 https://bugzilla.suse.com/1246915 SUSE Bug 1246915 Octo-STS is a GitHub App that acts like a Security Token Service (STS) for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information. Upgrade to v0.5.3 to resolve this issue. This version includes patch sets to sanitize input and redact logging. CVE-2025-52477 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-52477.html CVE-2025-52477 Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables rules for local services (DHCP, DNS...) that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to DHCP pool exhaustion and opens the door for other attacks. A patch is available at commit 2516fb19ad8428454cb4edfe70c0a5f0dc1da214. CVE-2025-52889 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-52889.html CVE-2025-52889 https://bugzilla.suse.com/1245365 SUSE Bug 1245365 Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables rules that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge. Commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8 contains a patch for the issue. CVE-2025-52890 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-52890.html CVE-2025-52890 https://bugzilla.suse.com/1245367 SUSE Bug 1245367 OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. This issue has been fixed in OpenBao v2.3.0 and later. Like with HCSEC-2025-09, there is no known workaround except to ensure properly formatted requests from all clients. CVE-2025-52893 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-52893.html CVE-2025-52893 https://bugzilla.suse.com/1245381 SUSE Bug 1245381 OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of service. In OpenBao v2.2.0 and later, manually setting the configuration option `disable_unauthed_rekey_endpoints=true` allows an operator to deny these rarely-used endpoints on global listeners. A patch is available at commit fe75468822a22a88318c6079425357a02ae5b77b. In a future OpenBao release communicated on OpenBao's website, the maintainers will set this to `true` for all users and provide an authenticated alternative. As a workaround, if an active proxy or load balancer sits in front of OpenBao, an operator can deny requests to these endpoints from unauthorized IP ranges. CVE-2025-52894 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-52894.html CVE-2025-52894 https://bugzilla.suse.com/1245389 SUSE Bug 1245389 File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application. The same is true for the database used by File Browser. On standard servers using File Browser prior to version 2.33.7 where the umask configuration has not been hardened before, this makes all the stated files readable by any operating system account. Version 2.33.7 fixes the issue. CVE-2025-52900 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-52900.html CVE-2025-52900 File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.9, access tokens are used as GET parameters. The JSON Web Token (JWT) which is used as a session identifier will get leaked to anyone having access to the URLs accessed by the user. This will give an attacker full access to a user's account and, in consequence, to all sensitive files the user has access to. This issue has been patched in version 2.33.9. CVE-2025-52901 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-52901.html CVE-2025-52901 File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The Markdown preview function of File Browser prior to v2.33.7 is vulnerable to Stored Cross-Site-Scripting (XSS). Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser. Version 2.33.7 contains a fix for the issue. CVE-2025-52902 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-52902.html CVE-2025-52902 File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In version 2.32.0, the Command Execution feature of File Browser only allows the execution of shell command which have been predefined on a user-specific allowlist. Many tools allow the execution of arbitrary different commands, rendering this limitation void. The concrete impact depends on the commands being granted to the attacker, but the large number of standard commands allowing the execution of subcommands makes it likely that every user having the `Execute commands` permissions can exploit this vulnerability. Everyone who can exploit it will have full code execution rights with the uid of the server process. Until this issue is fixed, the maintainers recommend to completely disable `Execute commands` for all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application's configuration. As a defense-in-depth measure, organizations not requiring command execution should operate the Filebrowser from a distroless container image. A patch version has been pushed to disable the feature for all existent installations, and making it opt-in. A warning has been added to the documentation and is printed on the console if the feature is enabled. Due to the project being in maintenance-only mode, the bug has not been fixed. The fix is tracked on pull request 5199. CVE-2025-52903 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-52903.html CVE-2025-52903 File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In version 2.32.0 of the web application, all users have a scope assigned, and they only have access to the files within that scope. The Command Execution feature of Filebrowser allows the execution of shell commands which are not restricted to the scope, potentially giving an attacker read and write access to all files managed by the server. Until this issue is fixed, the maintainers recommend to completely disable `Execute commands` for all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application's configuration. As a defense-in-depth measure, organizations not requiring command execution should operate the Filebrowser from a distroless container image. A patch version has been pushed to disable the feature for all existent installations, and making it opt-in. A warning has been added to the documentation and is printed on the console if the feature is enabled. Due to the project being in maintenance-only mode, the bug has not been fixed. Fix is tracked on pull request 5199. CVE-2025-52904 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-52904.html CVE-2025-52904 File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.10, the implementation of the allowlist is erroneous, allowing a user to execute more shell commands than they are authorized for. The concrete impact of this vulnerability depends on the commands configured, and the binaries installed on the server or in the container image. Due to the missing separation of scopes on the OS-level, this could give an attacker access to all files managed the application, including the File Browser database. This issue has been patched in version 2.33.10. CVE-2025-52995 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-52995.html CVE-2025-52995 File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions 2.32.0 and prior, the implementation of password protected links is error-prone, resulting in potential unprotected sharing of a file through a direct download link. This link can either be shared unknowingly by a user or discovered from various locations such as the browser history or the log of a proxy server used. At time of publication, no known patched versions are available. CVE-2025-52996 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-52996.html CVE-2025-52996 File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a brute-force attack to retrieve the passwords of all accounts in a given instance. This issue has been patched in version 2.34.1. CVE-2025-52997 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-52997.html CVE-2025-52997 The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information. CVE-2025-53512 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-53512.html CVE-2025-53512 The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through the affected charm. CVE-2025-53513 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-53513.html CVE-2025-53513 Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking. This issue has been resolved in Helm v3.18.4. CVE-2025-53547 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-53547.html CVE-2025-53547 https://bugzilla.suse.com/1246150 SUSE Bug 1246150 Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the path of the file to write is not checked, potentially leading to zip slips. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has been implemented by commit 47d188f and shipped in v0.1.4. CVE-2025-53632 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-53632.html CVE-2025-53632 Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the size of the decoded content is not checked, potentially leading to zip bombs decompression. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has been implemented by commit 14042aa and shipped in v0.1.4. CVE-2025-53633 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-53633.html CVE-2025-53633 Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. The HTTP Gateway processes headers, but with no timeout set. With a slow loris attack, an attacker could cause Denial of Service (DoS). Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has been implemented by commit 1385bd8 and shipped in v0.1.4. CVE-2025-53634 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-53634.html CVE-2025-53634 File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser's authentication system issues long-lived JWT tokens that remain valid even after the user logs out. As of time of publication, no known patches exist. CVE-2025-53826 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-53826.html CVE-2025-53826 File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.38.0, a Denial of Service (DoS) vulnerability exists in the file processing logic when reading a file on endpoint `Filebrowser-Server-IP:PORT/files/{file-name}` . While the server correctly handles and stores uploaded files, it attempts to load the entire content into memory during read operations without size checks or resource limits. This allows an authenticated user to upload a large file and trigger uncontrolled memory consumption on read, potentially crashing the server and making it unresponsive. As of time of publication, no known patches are available. CVE-2025-53893 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-53893.html CVE-2025-53893 apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue. CVE-2025-53945 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-53945.html CVE-2025-53945 https://bugzilla.suse.com/1246746 SUSE Bug 1246746 melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances. Version 0.29.5 fixes the issue. CVE-2025-54059 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-54059.html CVE-2025-54059 https://bugzilla.suse.com/1246745 SUSE Bug 1246745 LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. In versions before 2.2.1, there is a critical SQL Injection vulnerability in the getLast API functionality of the eKuiper project. This flaw allows unauthenticated remote attackers to execute arbitrary SQL statements on the underlying SQLite database by manipulating the table name input in an API request. Exploitation can lead to data theft, corruption, or deletion, and full database compromise. This is fixed in version 2.2.1. CVE-2025-54379 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-54379.html CVE-2025-54379 A flaw was found in the temporary user record that authd uses in the pre-auth NSS. As a result, a user login for the first time will be considered to be part of the root group in the context of that SSH session. CVE-2025-5689 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-5689.html CVE-2025-5689 Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container images. Particularly, when using the CLI flag --remote-image on untrusted container images. CVE-2025-5981 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-5981.html CVE-2025-5981 https://bugzilla.suse.com/1244726 SUSE Bug 1244726 An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0. The open redirect can be chained with path traversal vulnerabilities to achieve XSS. Fixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01 CVE-2025-6023 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-6023.html CVE-2025-6023 https://bugzilla.suse.com/1246735 SUSE Bug 1246735 A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack. CVE-2025-6032 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-6032.html CVE-2025-6032 https://bugzilla.suse.com/1245320 SUSE Bug 1245320 Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it. CVE-2025-6224 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-6224.html CVE-2025-6224 Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of recently created posts. CVE-2025-6226 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-6226.html CVE-2025-6226 Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API. CVE-2025-6227 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-6227.html CVE-2025-6227 Mattermost versions 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to sanitize input paths of file attachments in the bulk import JSONL file, which allows a system admin to read arbitrary system files via path traversal. CVE-2025-6233 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-6233.html CVE-2025-6233 Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch. The Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and update the configuration. This can lead to arbitrary command execution and endpoint takeover. To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the "Investigator' role). CVE-2025-6264 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-6264.html CVE-2025-6264 https://bugzilla.suse.com/1245123 SUSE Bug 1245123 Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line arguments can be exposed when executing Snyk CLI in DEBUG or DEBUG/TRACE mode. The issue affects the following Snyk commands: 1. When snyk container test or snyk container monitor commands are run against a container registry, with debug mode enabled, the container registry credentials may be written into the local Snyk CLI debug log. This only happens with credentials specified in environment variables (SNYK_REGISTRY_USERNAME and SNYK_REGISTRY_PASSWORD), or in the CLI (--password/-p and --username/-u). 2. When snyk auth command is executed with debug mode enabled AND the log level is set to TRACE, the Snyk access / refresh credential tokens used to connect the CLI to Snyk may be written into the local CLI debug logs. 3. When snyk iac test is executed with a Remote IAC Custom rules bundle, debug mode enabled, AND the log level is set to TRACE, the docker registry token may be written into the local CLI debug logs. CVE-2025-6624 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250730T213748-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-6624.html CVE-2025-6624