opensuse/govulncheck-vulndb&distro=openSUSE Leap 16.0

Vulnerabilities (1,719)

• CVE-2025-13888CriDec 15, 2025
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions in other namespaces, including privileged namespaces. An authenticated attacker can then use these elevated permissions to

• CVE-2025-13281MedDec 14, 2025
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (i

• CVE-2025-67819MedDec 12, 2025
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arb

• CVE-2025-67818HigDec 12, 2025
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path (e.g., /etc/...) or use parent directory traversal (../../..) to escape the restore root when a backup is restored, potent

• CVE-2025-67508HigDec 12, 2025
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  gardenctl is a command-line client for the Gardener which configures access to clusters and cloud provider CLI tools. When using non‑POSIX shells such as Fish and PowerShell, versions 2.11.0 and below of gardenctl allow an attacker with administrative privileges for a Gardener pr

• CVE-2025-64702MedDec 11, 2025
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large header field section (man

• CVE-2025-67717MedDec 11, 2025
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 disclose the total number of instance users to authenticated users, regardless of their specific permissions. While this does not leak individual user data or PII, d

• CVE-2025-67713MedDec 11, 2025
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false, enabling phishing flows after login. Protocol-relative URLs like //ikotaslabs.com have an empty scheme and pass that check, allowing post-login red

• CVE-2025-34430MedDec 10, 2025
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  1Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the panel name management functionality. The affected endpoint does not implement CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malic

• CVE-2025-34429HigDec 10, 2025
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality. The port-change endpoint lacks CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage th

• CVE-2025-65754MedDec 10, 2025
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Cross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a filename.

• CVE-2025-34410HigDec 10, 2025
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the Change Username functionality available from the settings panel (/settings/panel). The endpoint does not implement CSRF protections such as anti-CSRF tokens or Origin/Referer validat

• CVE-2025-8110HigKEVDec 10, 2025
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

• CVE-2025-67499MedDec 10, 2025
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. Versions 1.6.0 through 1.8.0 inadvertently forward all traffic with the same destination port as the host port when the portmap plugin is configured with the nftabl

• CVE-2025-67495HigDec 9, 2025
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  ZITADEL is an open-source identity infrastructure tool. Versions 4.0.0-rc.1 through 4.7.0 are vulnerable to DOM-Based XSS through the Zitadel V2 logout endpoint. The /logout endpoint insecurely routes to a value that is supplied in the post_logout_redirect GET parameter. As a res

• CVE-2025-67494CriDec 9, 2025
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host header as a trusted fallback for all deployments, including self-hosted

• CVE-2025-67488HigDec 9, 2025
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  SiYuan is self-hosted, open source personal knowledge management software. Versions 0.0.0-20251202123337-6ef83b42c7ce and below contain function importZipMd which is vulnerable to ZipSlips, allowing an authenticated user to overwrite files on the system. An authenticated user wit

• CVE-2025-66626HigDec 9, 2025
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions 3.6.13 and below and versions 3.7.0 through 3.7.4, contain unsafe untar code that handles symbolic links in archives. Concretely, the computation of a link's

• CVE-2025-66565CriDec 9, 2025
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values, including the zero UUID "00000

• CVE-2025-66508MedDec 9, 2025
  affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1

  1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin's default configuration which trusts all IP addresses as proxies (TrustedProxies = 0.0.0.0/0), allowing any client to spoof the X-Forwarded-For header. Since all IP-ba