TU
Product
Tumbleweed
On CISA KEVExploited in the wild
11
CVEs
1
On KEV
10.0
Max CVSS
2
New 30D
Severity mix
Critical 1High 5Medium 5Low 0
Watch
Add Tumbleweed to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-3306 In wildKEV | 10.0 | May 18 | ProFTPD Improper Access Control Vulnerability Affected: All versions, or not specified |
| CVE-2025-46810 | 8.5 | Sep 2 | A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate to root. This issue affects Tumbleweed:… Affected: ? before 2.11.29 |
| CVE-2023-32183 | 7.8 | Jul 7 | Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 package allows users with access to the hacluster to escalate to root This issue affects openSUSE… Affected: All versions, or not specified |
| CVE-2022-31250 | 7.8 | Jul 20 | A UNIX Symbolic Link (Symlink) Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root Affected: before 6.4.2-1.1 |
| CVE-2020-8026 | 7.8 | Aug 7 | A Incorrect Default Permissions vulnerability in the packaging of inn in openSUSE Leap 15.2, openSUSE Tumbleweed, openSUSE Leap 15.1 allows local attackers with control of the new… Affected: through 2.6.2-4.2 |
| CVE-2024-49506 | 7.3 | Nov 13 | Fixed temporary file path in aeon-checks allows fixing of disk encryption key Affected: before 1.0.2; before 1.2.4 |
| CVE-2025-53881 | 6.9 | Oct 2 | SUSE-specific logrotate configuration allows escalation from mail user/group to root Affected: ? before 4.98.2-lp156.248.1 |
| CVE-2026-104618 | 6.2 | Oct 15 | sdbootutil: world-readable debug log Affected: ? before 278458aeb7d8f995c0e3dc9d19d2dcba50795a42 |
| CVE-2024-49505 | 6.1 | Nov 13 | XSS vulnerability found in OpenSuse MirrorCache Affected: before 1.083 |
| CVE-2025-62875 | 5.5 | Nov 20 | Local DoS in OpenSMTPD via UNIX domain socket smtpd.sock Affected: before 7.8.0p0-1.1 |
| CVE-2026-104617 | 5.1 | Oct 15 | sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/<pid>/cmdline Affected: ? before 947e9dc09ce7c36b35a868e397e30245cc5544a1 |
Showing 11