govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2025:16287 Final 1 1 2025-07-03T00:00:00Z current 2025-07-03T00:00:00Z 2025-07-03T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media These are all security issues fixed in the govulncheck-vulndb-0.0.20250612T141001-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2025-16287 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2020-36846/ SUSE CVE CVE-2020-36846 page https://www.suse.com/security/cve/CVE-2022-31022/ SUSE CVE CVE-2022-31022 page https://www.suse.com/security/cve/CVE-2023-42818/ SUSE CVE CVE-2023-42818 page https://www.suse.com/security/cve/CVE-2025-0913/ SUSE CVE CVE-2025-0913 page https://www.suse.com/security/cve/CVE-2025-1792/ SUSE CVE CVE-2025-1792 page https://www.suse.com/security/cve/CVE-2025-22874/ SUSE CVE CVE-2025-22874 page https://www.suse.com/security/cve/CVE-2025-25207/ SUSE CVE CVE-2025-25207 page https://www.suse.com/security/cve/CVE-2025-25208/ SUSE CVE CVE-2025-25208 page https://www.suse.com/security/cve/CVE-2025-2571/ SUSE CVE CVE-2025-2571 page https://www.suse.com/security/cve/CVE-2025-29785/ SUSE CVE CVE-2025-29785 page https://www.suse.com/security/cve/CVE-2025-3230/ SUSE CVE CVE-2025-3230 page https://www.suse.com/security/cve/CVE-2025-3260/ SUSE CVE CVE-2025-3260 page https://www.suse.com/security/cve/CVE-2025-3454/ SUSE CVE CVE-2025-3454 page https://www.suse.com/security/cve/CVE-2025-3611/ SUSE CVE CVE-2025-3611 page https://www.suse.com/security/cve/CVE-2025-3913/ SUSE CVE CVE-2025-3913 page https://www.suse.com/security/cve/CVE-2025-4128/ SUSE CVE CVE-2025-4128 page https://www.suse.com/security/cve/CVE-2025-4573/ SUSE CVE CVE-2025-4573 page https://www.suse.com/security/cve/CVE-2025-4673/ SUSE CVE CVE-2025-4673 page https://www.suse.com/security/cve/CVE-2025-47950/ SUSE CVE CVE-2025-47950 page https://www.suse.com/security/cve/CVE-2025-48494/ SUSE CVE CVE-2025-48494 page https://www.suse.com/security/cve/CVE-2025-48495/ SUSE CVE CVE-2025-48495 page https://www.suse.com/security/cve/CVE-2025-48710/ SUSE CVE CVE-2025-48710 page https://www.suse.com/security/cve/CVE-2025-48865/ SUSE CVE CVE-2025-48865 page https://www.suse.com/security/cve/CVE-2025-48938/ SUSE CVE CVE-2025-48938 page https://www.suse.com/security/cve/CVE-2025-48948/ SUSE CVE CVE-2025-48948 page https://www.suse.com/security/cve/CVE-2025-48949/ SUSE CVE CVE-2025-48949 page https://www.suse.com/security/cve/CVE-2025-49011/ SUSE CVE CVE-2025-49011 page https://www.suse.com/security/cve/CVE-2025-49136/ SUSE CVE CVE-2025-49136 page https://www.suse.com/security/cve/CVE-2025-49140/ SUSE CVE CVE-2025-49140 page openSUSE Tumbleweed govulncheck-vulndb-0.0.20250612T141001-1.1 govulncheck-vulndb-0.0.20250612T141001-1.1 as a component of openSUSE Tumbleweed A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library. Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your IO::Compress::Brotli module to 0.007 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits. CVE-2020-36846 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-36846.html CVE-2020-36846 https://bugzilla.suse.com/1175825 SUSE Bug 1175825 Bleve is a text indexing library for go. Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. These HTTP methods pave way for exploitation of a node's filesystem where the bleve index resides, if the user has used bleve's own HTTP (bleve/http) handlers for exposing the access to the indexes. For instance, the CreateIndexHandler (`http/index_create.go`) and DeleteIndexHandler (`http/index_delete.go`) enable an attacker to create a bleve index (directory structure) anywhere where the user running the server has the write permissions and to delete recursively any directory owned by the same user account. Users who have used the bleve/http package for exposing access to bleve index without the explicit handling for the Role Based Access Controls(RBAC) of the index assets would be impacted by this issue. Version 2.5.0 relocated the `http/` dir used _only_ by bleve-explorer to `blevesearch/bleve-explorer`, thereby addressing the issue. However, the http package is purely intended to be used for demonstration purposes. Bleve was never designed handle the RBACs, nor it was ever advertised to be used in that way. The collaborators of this project have decided to stay away from adding any authentication or authorization to bleve project at the moment. The bleve/http package is mainly for demonstration purposes and it lacks exhaustive validation of the user inputs as well as any authentication and authorization measures. It is recommended to not use bleve/http in production use cases. CVE-2022-31022 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-31022.html CVE-2022-31022 JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability by utilizing a disclosed public key to attempt brute-force authentication against the SSH service This issue has been patched in versions 3.6.5 and 3.5.6. Users are advised to upgrade. There are no known workarounds for this issue. CVE-2023-42818 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-42818.html CVE-2023-42818 os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink. CVE-2025-0913 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-0913.html CVE-2025-0913 https://bugzilla.suse.com/1244157 SUSE Bug 1244157 Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint. CVE-2025-1792 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-1792.html CVE-2025-1792 Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon. CVE-2025-22874 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-22874.html CVE-2025-22874 https://bugzilla.suse.com/1244158 SUSE Bug 1244158 The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer persona to add callbacks to be executed to HTTP endpoints once the authorization process is completed. It was found that an attacker with developer persona access can add a large number of those callbacks to be executed by Authorino and as the authentication policy is enforced by a single instance of the service, this leada to a Denial of Service in Authorino while processing the post-authorization callbacks. CVE-2025-25207 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-25207.html CVE-2025-25207 A Developer persona can bring down the Authorino service, preventing the evaluation of all AuthPolicies on the cluster CVE-2025-25208 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-25208.html CVE-2025-25208 Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to clear Google OAuth credentials when converting user accounts to bot accounts, allowing attackers to gain unauthorized access to bot accounts via the Google OAuth signup flow. CVE-2025-2571 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-2571.html CVE-2025-2571 quic-go is an implementation of the QUIC protocol in Go. The loss recovery logic for path probe packets that was added in the v0.50.0 release can be used to trigger a nil-pointer dereference by a malicious QUIC client. In order to do so, the attacker first sends valid QUIC packets from different remote addresses (thereby triggering the newly added path validation logic: the server sends path probe packets), and then sending ACKs for packets received from the server specifically crafted to trigger the nil-pointer dereference. v0.50.1 contains a patch that fixes the vulnerability. This release contains a test that generates random sequences of sent packets (both regular and path probe packets), that was used to verify that the patch actually covers all corner cases. No known workarounds are available. CVE-2025-29785 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-29785.html CVE-2025-29785 https://bugzilla.suse.com/1243936 SUSE Bug 1243936 Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previously issued tokens. CVE-2025-3230 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-3230.html CVE-2025-3230 A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerability affects all API versions (v0alpha1, v1alpha1, v2alpha1). Impact: - Viewers can view all dashboards/folders regardless of permissions - Editors can view/edit/delete all dashboards/folders regardless of permissions - Editors can create dashboards in any folder regardless of permissions - Anonymous users with viewer/editor roles are similarly affected Organization isolation boundaries remain intact. The vulnerability only affects dashboard access and does not grant access to datasources. CVE-2025-3260 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-3260.html CVE-2025-3260 This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources that implement route-specific permissions, including Alertmanager and certain Prometheus-based datasources. CVE-2025-3454 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-3454.html CVE-2025-3454 https://bugzilla.suse.com/1241683 SUSE Bug 1241683 Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team endpoints, even when explicitly configured with 'No access' to Teams in the System Console. CVE-2025-3611 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-3611.html CVE-2025-3611 Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly validate permissions when changing team privacy settings, allowing team administrators without the 'invite user' permission to access and modify team invite IDs via the /api/v4/teams/:teamId/privacy endpoint. CVE-2025-3913 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-3913.html CVE-2025-3913 Mattermost versions 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly restrict API access to team information, allowing guest users to bypass permissions and view information about public teams they are not members of via a direct API call to /api/v4/teams/{team_id}. CVE-2025-4128 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-4128.html CVE-2025-4128 Mattermost versions 10.7.x <= 10.7.1, 10.6.x <= 10.6.3, 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly validate LDAP group ID attributes, allowing an authenticated administrator with PermissionSysconsoleWriteUserManagementGroups permission to execute LDAP search filter injection via the PUT /api/v4/ldap/groups/{remote_id}/link API when objectGUID is configured as the Group ID Attribute. CVE-2025-4573 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-4573.html CVE-2025-4573 Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information. CVE-2025-4673 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-4673.html CVE-2025-4673 https://bugzilla.suse.com/1244156 SUSE Bug 1244156 CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service (DoS) vulnerability exists in the CoreDNS DNS-over-QUIC (DoQ) server implementation. The server previously created a new goroutine for every incoming QUIC stream without imposing any limits on the number of concurrent streams or goroutines. A remote, unauthenticated attacker could open a large number of streams, leading to uncontrolled memory consumption and eventually causing an Out Of Memory (OOM) crash - especially in containerized or memory-constrained environments. The patch in version 1.12.2 introduces two key mitigation mechanisms: `max_streams`, which caps the number of concurrent QUIC streams per connection with a default value of `256`; and `worker_pool_size`, which Introduces a server-wide, bounded worker pool to process incoming streams with a default value of `1024`. This eliminates the 1:1 stream-to-goroutine model and ensures that CoreDNS remains resilient under high concurrency. Some workarounds are available for those who are unable to upgrade. Disable QUIC support by removing or commenting out the `quic://` block in the Corefile, use container runtime resource limits to detect and isolate excessive memory usage, and/or monitor QUIC connection patterns and alert on anomalies. CVE-2025-47950 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-47950.html CVE-2025-47950 https://bugzilla.suse.com/1244331 SUSE Bug 1244331 Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. When using end-to-end encryption, a stored cross-site scripting vulnerability can be exploited by uploading a file with JavaScript code embedded in the filename. After upload and every time someone opens the upload list, the script is then parsed. Prior to version 2.0.0, there was no user permission system implemented, therefore all authenticated users were already able to see and modify all resources, even if end-to-end encrypted, as the encryption key had to be the same for all users using a version prior to 2.0.0. If a user is the only authenticated user using Gokapi, they are not affected. This issue has been fixed in v2.0.0. A possible workaround would be to disable end-to-end encryption. CVE-2025-48494 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-48494.html CVE-2025-48494 Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. By renaming the friendly name of an API key, an authenticated user could inject JS into the API key overview, which would also be executed when another user clicks on his API tab. Prior to version 2.0.0, there was no user permission system implemented, therefore all authenticated users were already able to see and modify all resources, even if end-to-end encrypted, as the encryption key had to be the same for all users of versions prior to 2.0.0. If a user is the only authenticated user using Gokapi, they are not affected. This issue has been fixed in v2.0.0. A workaround would be to not open the API page if it is possible that another user might have injected code. CVE-2025-48495 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-48495.html CVE-2025-48495 kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary container images. This can lead to a confused-deputy scenario where kro's controllers deploy and run attacker-controlled images, resulting in unauthenticated remote code execution on cluster nodes. CVE-2025-48710 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-48710.html CVE-2025-48710 Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. Prior to version 1.6.6, Fabio allows clients to remove X-Forwarded headers (except X-Forwarded-For) due to a vulnerability in how it processes hop-by-hop headers. Fabio adds HTTP headers like X-Forwarded-Host and X-Forwarded-Port when routing requests to backend applications. Since the receiving application should trust these headers, allowing HTTP clients to remove or modify them creates potential security vulnerabilities. Some of these custom headers can be removed and, in certain cases, manipulated. The attack relies on the behavior that headers can be defined as hop-by-hop via the HTTP Connection header. This issue has been patched in version 1.6.6. CVE-2025-48865 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-48865.html CVE-2025-48865 go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URLs provided by GitHub with local file paths for browsing. In `2.12.1`, `Browser.Browse()` has been enhanced to allow and disallow a variety of scenarios to avoid opening or executing files on the filesystem without unduly impacting HTTP URLs. No known workarounds are available other than upgrading. CVE-2025-48938 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-48938.html CVE-2025-48938 https://bugzilla.suse.com/1243930 SUSE Bug 1243930 Navidrome is an open source web-based music collection server and streamer. A permission verification flaw in versions prior to 0.56.0 allows any authenticated regular user to bypass authorization checks and perform administrator-only transcoding configuration operations, including creating, modifying, and deleting transcoding settings. In the threat model where administrators are trusted but regular users are not, this vulnerability represents a significant security risk when transcoding is enabled. Version 0.56.0 patches the issue. CVE-2025-48948 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-48948.html CVE-2025-48948 Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulnerability due to improper input validation on the `role` parameter within the API endpoint `/api/artist`. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information. Version 0.56.0 contains a patch for the issue. CVE-2025-48949 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-48949.html CVE-2025-48949 SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats on the arrow'ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected. Version 1.44.2 fixes the issue. As a workaround, do not use caveats in the schema over an arrow'ed relation. CVE-2025-49011 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-49011.html CVE-2025-49011 listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` and `expandenv` template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the `{{ env }}` template expression to capture sensitive environment variables. Users should upgrade to v5.0.2 to mitigate the issue. CVE-2025-49136 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-49136.html CVE-2025-49136 Pion Interceptor is a framework for building RTP/RTCP communication software. Versions v0.1.36 through v0.1.38 contain a bug in a RTP packet factory that can be exploited to trigger a panic with Pion based SFU via crafted RTP packets, This only affect users that use pion/interceptor. Users should upgrade to v0.1.39 or later, which validates that: `padLen > 0 && padLen <= payloadLength` and return error on overflow, avoiding panic. If upgrading is not possible, apply the patch from the pull request manually or drop packets whose P-bit is set but whose padLen is zero or larger than the remaining payload. CVE-2025-49140 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250612T141001-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-49140.html CVE-2025-49140