By vendor

Opensuse vulnerabilities

Known CVEs affecting Opensuse products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

• CVE-2026-25707HIGH 8.8

  libzypp, the package management library used by openSUSE systems, contains a flaw in how it processes repository metadata that could allow an attacker to trick a user into downloading a malicious repository. When this happens, files anywhere on the system can be overwritten, potentially crashing the system or gaining administrative control. The vulnerability requires user interaction—someone must add or update a repository—but once triggered, the impact is severe.

• CVE-2026-44941HIGH 8.4

  A flaw in how openSUSE's libzypp library processes repository metadata (repomd.xml files) allows attackers who control a malicious repository to execute arbitrary file operations on target systems with root privileges. The vulnerability exists in the handling of the 'keyhint' option and stems from insufficient validation of file paths, enabling an attacker to inject or overwrite sensitive files. Exploitation requires that a user or system add and use the attacker's crafted repository, but once that happens, the impact is severe.