rpm package
opensuse/govulncheck-vulndb&distro=openSUSE Leap 16.0
pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
Vulnerabilities (1,722)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-28342 | Hig | 7.5 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Mar 5, 2026 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. By issuing multiple parallel req | |
| CVE-2026-29054 | Hig | 7.5 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Mar 5, 2026 | Traefik is an HTTP reverse proxy and load balancer. From version 2.11.9 to 2.11.37 and from version 3.1.3 to 3.6.8, there is a potential vulnerability in Traefik managing the Connection header with X-Forwarded headers. When Traefik processes HTTP/1.1 requests, the protection put | |
| CVE-2026-27944 | Cri | 9.8 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Mar 5, 2026 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticat | |
| CVE-2026-26999 | Hig | 7.5 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Mar 5, 2026 | Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing TLS handshake on TCP routers. When Traefik processes a TLS connection on a TCP router, the read deadline used to bound protocol sniffing | |
| CVE-2026-26998 | Med | 4.4 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Mar 5, 2026 | Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing the ForwardAuth middleware responses. When Traefik is configured to use the ForwardAuth middleware, the response body from the authentic | |
| CVE-2026-26276 | Hig | 7.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Mar 5, 2026 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, an attacker can store an HTML/JavaScript payload in a repository’s Milestone name, and when another user selects that Milestone on the New Issue page (/issues/new), a DOM-Based XSS is triggered. This issue h | |
| CVE-2026-26196 | Med | 5.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Mar 5, 2026 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, gogs api still accepts tokens in url params like token and access_token, which can leak through logs, browser history, and referrers. This issue has been patched in version 0.14.2. | |
| CVE-2026-26195 | Med | 6.1 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Mar 5, 2026 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, stored xss is still possible through unsafe template rendering that mixes user input with safe plus permissive sanitizer handling of data urls. This issue has been patched in version 0.14.2. | |
| CVE-2026-26194 | Hig | 7.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Mar 5, 2026 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options get injected and mess with the process. Th | |
| CVE-2026-26022 | Hig | 8.7 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Mar 5, 2026 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, a stored cross-site scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows data: URI schemes, enabling authenticated users | |
| CVE-2026-25921 | Cri | 9.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Mar 5, 2026 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in version 0.14.2 | |
| CVE-2025-15558 | Hig | 8.0 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Mar 4, 2026 | Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are | |
| CVE-2025-62879 | Med | 6.8 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Mar 4, 2026 | A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both accessKey and secretKey) into the rancher-backup-operator pod's logs. | |
| CVE-2026-3351 | Med | 4.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Mar 3, 2026 | Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certificate fingerprints trusted by the lxd server. | |
| CVE-2026-28407 | Med | 5.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Feb 27, 2026 | malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to pres | |
| CVE-2026-28406 | Hig | 8.2 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Feb 27, 2026 | kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using `filepath.Join(dest, cleanedName)` without enforcing that the final path st | |
| CVE-2026-28268 | Cri | 9.8 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Feb 27, 2026 | Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upo | |
| CVE-2026-27734 | Med | 6.5 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Feb 27, 2026 | Beszel is a server monitoring platform. Prior to version 0.18.2, the hub's authenticated API endpoints GET /api/beszel/containers/logs and GET /api/beszel/containers/info pass the user-supplied "container" query parameter to the agent without validation. The agent constructs Dock | |
| CVE-2026-28280 | Med | 6.1 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Feb 26, 2026 | osctrl is an osquery management solution. Prior to version 0.5.0, a stored cross-site scripting (XSS) vulnerability exists in the `osctrl-admin` on-demand query list. A user with query-level permissions can inject arbitrary JavaScript via the query parameter when running an on-de | |
| CVE-2026-28279 | Hig | 7.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Feb 26, 2026 | osctrl is an osquery management solution. Prior to version 0.5.0, an OS command injection vulnerability exists in the `osctrl-admin` environment configuration. An authenticated administrator can inject arbitrary shell commands via the hostname parameter when creating or editing e |
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. By issuing multiple parallel req
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Traefik is an HTTP reverse proxy and load balancer. From version 2.11.9 to 2.11.37 and from version 3.1.3 to 3.6.8, there is a potential vulnerability in Traefik managing the Connection header with X-Forwarded headers. When Traefik processes HTTP/1.1 requests, the protection put
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticat
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing TLS handshake on TCP routers. When Traefik processes a TLS connection on a TCP router, the read deadline used to bound protocol sniffing
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing the ForwardAuth middleware responses. When Traefik is configured to use the ForwardAuth middleware, the response body from the authentic
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, an attacker can store an HTML/JavaScript payload in a repository’s Milestone name, and when another user selects that Milestone on the New Issue page (/issues/new), a DOM-Based XSS is triggered. This issue h
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, gogs api still accepts tokens in url params like token and access_token, which can leak through logs, browser history, and referrers. This issue has been patched in version 0.14.2.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, stored xss is still possible through unsafe template rendering that mixes user input with safe plus permissive sanitizer handling of data urls. This issue has been patched in version 0.14.2.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options get injected and mess with the process. Th
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, a stored cross-site scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows data: URI schemes, enabling authenticated users
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in version 0.14.2
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both accessKey and secretKey) into the rancher-backup-operator pod's logs.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certificate fingerprints trusted by the lxd server.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to pres
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using `filepath.Join(dest, cleanedName)` without enforcing that the final path st
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upo
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
Beszel is a server monitoring platform. Prior to version 0.18.2, the hub's authenticated API endpoints GET /api/beszel/containers/logs and GET /api/beszel/containers/info pass the user-supplied "container" query parameter to the agent without validation. The agent constructs Dock
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
osctrl is an osquery management solution. Prior to version 0.5.0, a stored cross-site scripting (XSS) vulnerability exists in the `osctrl-admin` on-demand query list. A user with query-level permissions can inject arbitrary JavaScript via the query parameter when running an on-de
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
osctrl is an osquery management solution. Prior to version 0.5.0, an OS command injection vulnerability exists in the `osctrl-admin` environment configuration. An authenticated administrator can inject arbitrary shell commands via the hostname parameter when creating or editing e
Page 57 of 87