rpm package
opensuse/govulncheck-vulndb&distro=openSUSE Leap 16.0
pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
Vulnerabilities (1,722)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-68152 | Med | 4.9 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Apr 3, 2026 | Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, it is possible that a compromised workload mac | |
| CVE-2026-5469 | Med | 4.7 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Apr 3, 2026 | A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclo | |
| CVE-2026-5468 | Low | 3.5 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Apr 3, 2026 | A security flaw has been discovered in Casdoor 2.356.0. This affects the function dangerouslySetInnerHTML. Performing a manipulation of the argument formCss/formCssMobile/formSideHtml results in cross site scripting. The attack can be initiated remotely. The exploit has been rele | |
| CVE-2026-28736 | Med | 4.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Apr 3, 2026 | ** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and n | |
| CVE-2026-25773 | Hig | 8.1 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Apr 3, 2026 | ** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories. An attacker can inject a malicious SQL payload into the category id field, which is stored in the database and l | |
| CVE-2026-5467 | Med | 4.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Apr 3, 2026 | A vulnerability was identified in Casdoor 2.356.0. Affected by this issue is some unknown functionality of the component OAuth Authorization Request Handler. Such manipulation of the argument redirect_uri leads to open redirect. It is possible to launch the attack remotely. The e | |
| CVE-2026-34762 | Low | 2.7 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Apr 2, 2026 | Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API accepts an IMSI identifier from both the URL path and the JSON request body but never verifies they match. This allows an authenticated NetworkManager to modify any | |
| CVE-2026-34761 | Med | 5.8 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Apr 2, 2026 | Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, Ella Core panics when processing a NGAP handover failure message. An attacker able to cause a gNodeB to send NGAP handover failure messages to Ella Core can crash the process, causing service disruption | |
| CVE-2026-34742 | Hig | 8.1 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Apr 2, 2026 | The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTT | |
| CVE-2026-34581 | Hig | 8.1 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Apr 2, 2026 | goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec. This issue has been patched in version 2.0. | |
| CVE-2026-34828 | Hig | 7.1 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Apr 2, 2026 | listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically passwo | |
| CVE-2026-33544 | Hig | 7.7 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Apr 2, 2026 | Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations (GenericOAuthService, GithubOAuthService, GoogleOAuthService) store PKCE verifiers and access tokens as mutable struct fields on singleton instances shared acro | |
| CVE-2026-34530 | Med | 6.9 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Apr 1, 2026 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the SPA index page in File Browser is vulnerable to Stored Cross-Site Scripting (XSS) via admin-controlled branding fi | |
| CVE-2026-34529 | Hig | 7.6 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Apr 1, 2026 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the EPUB preview function in File Browser is vulnerable to Stored Cross-Site Scripting (XSS). JavaScript embedded in a | |
| CVE-2026-34528 | Hig | 8.1 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Apr 1, 2026 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the signupHandler in File Browser applies default user permissions via d.settings.Defaults.Apply(user), then strips on | |
| CVE-2026-5199 | Low | — | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Apr 1, 2026 | A writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster. Exploitation requires the attacker to know or guess specific victim workflow ID(s) and, for signal operations, signal names. T | |
| CVE-2026-33990 | Cri | 9.1 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Apr 1, 2026 | Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Prior to version 1.1.25, Docker Model Runner contains an SSRF vulnerability in its OCI registry token exchange flow. When pulling a model, Model Runner follows the realm URL from the reg | |
| CVE-2026-4370 | Cri | 10.0 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Apr 1, 2026 | A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perform proper TLS client and server authentication. Specifically, the Juju controller's database endpoint does not validat | |
| CVE-2026-34605 | Med | 6.1 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Mar 31, 2026 | SiYuan is a personal knowledge management system. From version 3.6.0 to before version 3.6.2, the SanitizeSVG function introduced in version 3.6.0 to fix XSS in the unauthenticated /api/icon/getDynamicIcon endpoint can be bypassed by using namespace-prefixed element names such as | |
| CVE-2026-34585 | Hig | 8.6 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Mar 31, 2026 | SiYuan is a personal knowledge management system. Prior to version 3.6.2, a vulnerability allows crafted block attribute values to bypass server-side attribute escaping when an HTML entity is mixed with raw special characters. An attacker can embed a malicious IAL value inside a |
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, it is possible that a compromised workload mac
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclo
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
A security flaw has been discovered in Casdoor 2.356.0. This affects the function dangerouslySetInnerHTML. Performing a manipulation of the argument formCss/formCssMobile/formSideHtml results in cross site scripting. The attack can be initiated remotely. The exploit has been rele
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who knows a victim's fileID to read the content of the file. NOTE: Focalboard as a standalone product is not maintained and n
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories. An attacker can inject a malicious SQL payload into the category id field, which is stored in the database and l
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
A vulnerability was identified in Casdoor 2.356.0. Affected by this issue is some unknown functionality of the component OAuth Authorization Request Handler. Such manipulation of the argument redirect_uri leads to open redirect. It is possible to launch the attack remotely. The e
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API accepts an IMSI identifier from both the URL path and the JSON request body but never verifies they match. This allows an authenticated NetworkManager to modify any
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, Ella Core panics when processing a NGAP handover failure message. An attacker able to cause a gNodeB to send NGAP handover failure messages to Ella Core can crash the process, causing service disruption
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTT
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
goshs is a SimpleHTTPServer written in Go. From version 1.1.0 to before version 2.0.0-beta.2, when using the Share Token it is possible to bypass the limited selected file download with all the gosh functionalities, including code exec. This issue has been patched in version 2.0.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically passwo
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations (GenericOAuthService, GithubOAuthService, GoogleOAuthService) store PKCE verifiers and access tokens as mutable struct fields on singleton instances shared acro
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the SPA index page in File Browser is vulnerable to Stored Cross-Site Scripting (XSS) via admin-controlled branding fi
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the EPUB preview function in File Browser is vulnerable to Stored Cross-Site Scripting (XSS). JavaScript embedded in a
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the signupHandler in File Browser applies default user permissions via d.settings.Defaults.Apply(user), then strips on
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
A writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster. Exploitation requires the attacker to know or guess specific victim workflow ID(s) and, for signal operations, signal names. T
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Prior to version 1.1.25, Docker Model Runner contains an SSRF vulnerability in its OCI registry token exchange flow. When pulling a model, Model Runner follows the realm URL from the reg
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perform proper TLS client and server authentication. Specifically, the Juju controller's database endpoint does not validat
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
SiYuan is a personal knowledge management system. From version 3.6.0 to before version 3.6.2, the SanitizeSVG function introduced in version 3.6.0 to fix XSS in the unauthenticated /api/icon/getDynamicIcon endpoint can be bypassed by using namespace-prefixed element names such as
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
SiYuan is a personal knowledge management system. Prior to version 3.6.2, a vulnerability allows crafted block attribute values to bypass server-side attribute escaping when an HTML entity is mixed with raw special characters. An attacker can embed a malicious IAL value inside a
Page 42 of 87